Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,228 results · page 1 of 45
Oct 28, 2026Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability.CVE-2026-118615 · Other software · Ultralytics · reported by zdi-disclosures@trendmicro.comHigh 7.8
Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torch_safe_load function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-30122.
- Product
- Ultralytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Customer Engagement System: Does not safely build the SQL statements that store a popup's page and category visibility rulesCVE-2026-115224 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
- Product
- Customer Engagement System
- Fixed in
- 2.0.2
- What to do
- Update Customer Engagement System to 2.0.2 or newer.
Oct 27, 2026NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenCVE-2026-118132 · Other software · NextChat · reported by cret@cert.org
NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later rendered using React’s dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema containing HTML or JavaScript markup and trick a user into loading it through the Plugin Editor, resulting in arbitrary JavaScript execution in the NextChat origin. Successful exploitation allows access to JavaScript‑readable cookies and other client‑side data associated with the NextChat application.
- Product
- NextChat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validatinCVE-2026-116895 · Other software · redaxo · reported by VulnCheckMedium 5.1
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RECVE-2026-116804 · Other software · cure53 · reported by VulnCheckMedium 5.1
DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths.CVE-2026-115533 · Other software · Hugging Face · reported by cret@cert.org
The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from_pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import_module() and getattr().
- Product
- LeRobot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2026Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.CVE-2026-115557 · Other software · Python Software Foundation · reported by cna@python.orgCritical 9.4
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comemudhra.we-have-a-problem.com
Oct 23, 2026GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas.CVE-2026-115887 · Other software · graphql-hive · reported by GitHubHigh 7.5
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.
- Product
- graphql-scalars
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getCVE-2026-115729 · Other software · pdfme · reported by VulnCheckHigh 8.9
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
- Product
- common
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer CVE-2026-98902 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 22, 2026Royal Elementor Addons: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CVE-2026-111851 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
- Product
- Royal Elementor Addons
- Affected
- up to 1.7.1068
- What to do
- Affects up to 1.7.1068. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation.CVE-2026-96390 · Websites & servers · reported by mlhess@drupal.orgMedium 4.3
Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS.CVE-2026-96371 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS.CVE-2026-96367 · Websites & servers · reported by mlhess@drupal.orgMedium 4.6
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS.CVE-2026-96363 · Websites & servers · reported by mlhess@drupal.org
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS.CVE-2026-87942 · Websites & servers · reported by mlhess@drupal.orgMedium 4.6
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.CVE-2026-114727 · Email & office · reported by MITREHigh 8.3
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Oct 21, 2026CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability.CVE-2026-92206 · Other software · CrewAI · reported by zdi-disclosures@trendmicro.comHigh 8.8
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository. The specific flaw exists within the load_agent_from_repository function. The process does not properly restrict a user-supplied argument before using it to import a module. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28387.
- Product
- CrewAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory CVE-2026-90799 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 1.3
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- Product
- Apache CouchDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Oct 20, 2026A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancemenCVE-2026-43847 · Other software · Advantech · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4High 8.2
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
- Product
- ADAM-3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvantech.comcsa.gov.sg
Oct 19, 2026JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execCVE-2026-109443 · Other software · jd-opensource · reported by VulnCheckHigh 8.7
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.
- Product
- JoySafeter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate backCVE-2026-109395 · Other software · ning · reported by VulnCheckHigh 8.8
Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM heap memory into decompressed output or crash the JVM.
- Product
- compress-lzf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function.CVE-2026-112991 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 6.3
The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128). An authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be un
- Product
- misp-modules
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5.CVE-2026-112252 · Other software · Wuxi Wubang Security Software · reported by VulDBMedium 5.5
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Wubang Five-in-One Safety Production Management Information System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5.CVE-2026-112247 · Other software · Wuxi Wubang Security Software · reported by VulDBMedium 5.3
A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Five-in-One Safety Production Management Information System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=TruCVE-2026-112304 · Other software · Mindee · reported by VulnCheckHigh 7.7
docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.
- Product
- docTR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.CVE-2026-71253 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
- Product
- Apache Johnzon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop __init from ECC setup paths for re-probe safety Sashiko reports: "Does CVE-2026-98740 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop __init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed __init memory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the probe is deferred until after __init memory is freed." The a10 EDAC .setup callbacks (sdmmc, ethernet, nand, dma, usb, qspi) and their helpers (altr_init_a10_ecc_device_type, altr_init_a10_ecc_block) were marked __init. These run from the probe path, which may execute after init memory is freed -- e.g. a probe deferred via -EPROBE_DEFER that only succeeds once a late/module dependency appears, or a manual unbind/rebind. Calling __init code then dereferences freed memory. Remove __init so these functions remain valid at runtime.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe() regsafe() maps packet pointerCVE-2026-98627 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe() regsafe() maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however, preserve the displacement between registers that share a packet pointer ID. This is unsound because packet range is shared by ID. A bounds check on one class member updates every member, and a later access can consume the range through another member. Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers") folded the fixed pointer offset into r64 and removed the old off equality check, so two individually narrower registers can prune even when their displacement has changed. The explored path can then license an out-of-bounds packet access on the pruned path. Require matching range bases for packet pointers with an ID. Together with the existing ID mapping, this preserves the displacement between members of each packet-pointer class without adding per-ID state. Packet pointers without an ID remain unaffected.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 16, 2026destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them.CVE-2026-77474 · Other software · Dicklesworthstone · reported by GitHubHigh 7.1
destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached through split_command_segments in src/packs/mod.rs. a destructive command followed by nested or unclosed $( or $(( sequences. nested or unclosed $( and $(( sequences cause repeated rescanning of the remaining command suffix. a hung PreToolUse hook fails open, allowing the destructive command to proceed. This issue is fixed in version 0.6.6.
- Product
- destructive_command_guard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths coCVE-2026-106160 · Other software · Progress Software · reported by security@progress.comMedium 5.4
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
- Product
- Kendo UI for jQuery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient vCVE-2026-101290 · Other software · SICK AG · reported by psirt@sick.deHigh 7.5
A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition.
- Product
- Sick_Safetyscanners_Base CPP Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, noCVE-2026-110858 · Other software · gitpython-developers · reported by VulnCheckCritical 9.2
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.
- Product
- GitPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether theCVE-2026-103905 · Other software · JTL-Software GmbH · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.7
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many installations.
- Product
- JTL-Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WPCode: Does not correctly verify that a request is genuinely for the login screen before entering its snippet safe modeCVE-2026-101301 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
- Product
- WPCode
- Fixed in
- 2.4.0
- What to do
- Update WPCode to 2.4.0 or newer.
Oct 14, 2026Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlCVE-2026-105261 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.
- Product
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
- Fixed in
- 4.10.6
- What to do
- Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to 4.10.6 or newer.
Oct 13, 2026The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information AssuranCVE-2026-75120 · Other software · OpenText · reported by security@opentext.comCritical 9.3
The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishment
- Product
- Endpoint Investigator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to CVE-2026-110254 · Other software · Finsys · reported by VulnCheckMedium 5.3
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.
- Product
- dockhand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web.CVE-2026-102989 · Other software · TanStack · reported by GitHubCritical 9.3
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.
- Product
- router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe.CVE-2026-69150 · Other software · keepassxreboot · reported by GitHubMedium 4.3
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.
- Product
- keepassxc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execuCVE-2023-54406 · Other software · frappe · reported by VulnCheckMedium 6.9
Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.
- Product
- frappe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that coCVE-2026-85965 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.
- Product
- MarkLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 12, 2026Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to CVE-2026-85964 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.7
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.
- Product
- MarkLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 12, 2026In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response forCVE-2026-93693 · Other software · Progress · reported by security@progress.comMedium 6.5
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
- Product
- ShareFile Storage Zones Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP CVE-2026-108604 · Other software · TabularisDB · reported by VulnCheckMedium 5.8
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts.
- Product
- tabularis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook tCVE-2026-96396 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 4.9
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting containerCVE-2026-107335 · Other software · CISA · reported by ics-cert@hq.dhs.govMedium 6.5
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.
- Product
- Malcolm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary codCVE-2026-104078 · Other software · Obsidian · reported by VulnCheckHigh 8.4
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.
- Product
- Obsidian Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats reqCVE-2026-107449 · Computers, phones & browsers · linuxserver · reported by MITRELow 3.4
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
- Product
- Heimdall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1.CVE-2026-94584 · Other software · Brocade · reported by sirt@brocade.comLow 2.1
A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.