Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

2,403 results · page 1 of 49

Oct 30, 2026The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — inCVE-2026-111578 · WordPress plugins & themes · reported by WPScanHigh 7.5
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.
Fixed in
5.16.5
What to do
Update the plugin to 5.16.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 30, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-62302 · Other software · franklioxygen · reported by GitHubHigh 8.7
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is f
Product
MyTube
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 30, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-62301 · Other software · franklioxygen · reported by GitHubHigh 7.1
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password is configured. The frontend filter in `VideoContext.tsx` is only client-side, `roleBasedAuthMiddleware.ts` allows all visitor GET requests, and `storageService/videos.ts` performs `getVideos()` and `getVideoById(id)` queries without checking the caller's role or `visibility`. A visitor can enumerate `/api/videos` or request `/api/videos/:id` to retrieve hidden `visibility`=0 records, exposing titles, `sourceUrl` values, `videoPath` values, subtitle paths and `thumbnailPath` values. The `serveMountVideo()` path also serves mounted video files without `visibility` checks. Leaked paths work against unauthenticated `/videos/*` and `/subtitles/*` routes, allowing media downloads without credentials. The RSS visitor feed already filters `visibility`=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in vers
Product
MyTube
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 29, 2026joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.CVE-2026-119284 · Other software · authlib · reported by GitHubMedium 6.9
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.
Product
joserfc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 29, 2026joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.CVE-2026-119283 · Other software · authlib · reported by GitHubHigh 7.5
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.
Product
joserfc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 29, 2026HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticatedCVE-2026-102260 · Other software · HashiCorp · reported by security@hashicorp.comMedium 4.3
HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
Product
Nomad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.hashicorp.com
Oct 29, 2026A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface.CVE-2023-7357 · Other software · Revera · reported by PSIRT-CNA@flexerasoftware.comHigh 8.6
A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release.
Product
FlexNet Publisher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.flexera.com
Oct 29, 2026Appointment Booking: Does not escape several booking-form step content settings before rendering them on the public booking formCVE-2026-105258 · WordPress plugins & themes · reported by WPScanLow 3.5
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
Product
Appointment Booking
Fixed in
5.7.6
What to do
Update Appointment Booking to 5.7.6 or newer.
Full record and what to do →NVD record wpscan.com
Oct 28, 2026A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user CVE-2026-117625 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.com
A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured HTTP proxy.
Product
Jenkins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io
Oct 28, 2026Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can bCVE-2026-117620 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.com
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.
Product
Jenkins
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io
Oct 28, 2026Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no cheCVE-2026-111551 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large size and force a multi-gigabyte allocation. The affected paths are, in Kafka Streams, ProcessorRecordContext (header count), ChangedDeserializer (varint value length), CombinedKeySchema (foreign-key length, which could also produce a negative size), ProcessorMetadata (key length), and AssignmentInfo group-assignment decoding; and, in the clients library, ListDeserializer (used by ListSerde). Impact: An attacker can trigger the oversized allocation and raise an OutOfMemoryError that crashes the affected consumer or Kafka Streams thread; the broker and the rest of the cluster are unaffected. The reachable surface depends on the path: writing a crafted record to a Streams application's internal changelog or repartition topics, or committing crafted offset metadata to its consumer group (Streams internal paths); writing a crafted record to any topic that a consumer reads with ListSerde (ListDeserializer); or, as a member of a Str
Product
Apache Kafka
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kafka.apache.org openwall.com
Oct 26, 2026boneIO Black directly excludes several API endpoints from the authentication.CVE-2026-77061 · Other software · boneIO · reported by cvd@cert.plMedium 5.3
boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device. This issue was fixed in version 1.6.0: every API route requires an authenticated role, the interactive API documentation is disabled, and the serial number is withheld from anonymous callers.
Product
boneIO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record boneio.eu cert.pl
Oct 22, 2026Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APICVE-2026-115393 · Other software · bytecodealliance · reported by VulnCheckLow 1
Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.
Product
wasmtime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 21, 2026The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without hCVE-2026-78118 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 7
The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive. When the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_threa
Product
zephyr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 21, 2026Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with CVE-2026-114490 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comHigh 7.8
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server administrator over COM. Administrator roles are meant to confine such a credential to the domains its list names, and the REST API did not take it for the server administrator, but the COM API's server-administrator check read the administer_server permission as the whole server whatever list the grant carried. So the credential signed in through the Control Panel, or through a script run on the server, as the server administrator of every domain: it could read and change every domain's accounts and mail, rename any domain, map a domain alias onto any, write the server's settings and secrets, and create further server-administrator accounts. The COM API's domain-administrator check, asked with no domain, likewise let an account assigned the domainadmin role with a list of domains that leaves out the account's own domain administer that domain's ordinary accounts over COM. An account holding servera
Product
hMailServer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Oct 21, 2026Moloni: Does not perform capability or nonce checks on several of its authenticated AJAX actionsCVE-2026-106932 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
Product
Moloni
Fixed in
5.0.14
What to do
Update Moloni to 5.0.14 or newer.
Full record and what to do →NVD record wpscan.com
Oct 20, 2026Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access).CVE-2026-91399 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
Product
Primavera P6 Enterprise Project Portfolio Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access).CVE-2026-91376 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
Product
Primavera P6 Enterprise Project Portfolio Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).CVE-2026-101736 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.4
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core). Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Product
Primavera Unifier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control).CVE-2026-101735 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.1
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Product
Primavera Unifier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging).CVE-2026-101475 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and 25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Product
Primavera Unifier
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Oct 20, 2026Easy Property Listings: Does not perform authorisation checks on several of its contact-management read AJAX actionsCVE-2026-96903 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
Product
Easy Property Listings
Fixed in
3.5.27
What to do
Update Easy Property Listings to 3.5.27 or newer.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026Document Gallery: Does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markupCVE-2026-74921 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.
Product
Document Gallery
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 19, 2026ElementsReady Addons for Elementor: Does not perform authorization checks that halt execution in several of its settings-save handlersCVE-2026-91046 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.
Product
ElementsReady Addons for Elementor
Affected
up to 6.7.2
What to do
Affects up to 6.7.2. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Salon Booking System: Does not restrict several of its booking REST API routes to users with the appropriate capabilityCVE-2026-110012 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
Product
Salon Booking System
Fixed in
10.31.3
What to do
Update Salon Booking System to 10.31.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 15, 2026joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.CVE-2026-102946 · Other software · authlib · reported by GitHubCritical 9.1
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.
Product
joserfc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 15, 2026eaSYNC Booking: Does not perform authorization or nonce checks on several of its cancellation-related AJAX actionsCVE-2026-103304 · WordPress plugins & themes · reported by WPScanMedium 5.3
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
Product
eaSYNC Booking
Fixed in
1.3.31
What to do
Update eaSYNC Booking to 1.3.31 or newer.
Full record and what to do →NVD record wpscan.com
Oct 14, 2026VeraCrypt provides disk encryption with strong security based on TrueCrypt.CVE-2026-77572 · Other software · veracrypt · reported by GitHubLow 3.3
VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user who can open the intentionally user-accessible \.\VeraCrypt device can use TC_IOCTL_GET_RESOLVED_SYMLINK, TC_IOCTL_GET_DRIVE_PARTITION_INFO, VC_IOCTL_GET_DRIVE_GEOMETRY_EX, or the legacy TC_IOCTL_GET_DRIVE_GEOMETRY handler to make src/Driver/Ntdriver.c perform kernel-context symbolic-link or disk-device lookups outside the intended path scope. This can disclose low-sensitivity drive-letter targets, partition information, disk geometry, GPT or MBR state, and limited object-manager path metadata.
Product
VeraCrypt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 13, 2026Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged soCVE-2026-110160 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.2
Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 13, 2026Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information viCVE-2026-110146 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com issues.chromium.org
Oct 13, 2026Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks.CVE-2026-110247 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.4
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.6.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Oct 13, 2026HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an uCVE-2026-67165 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 5.4
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.
Product
Connections
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 12, 2026Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation.CVE-2026-109608 · Other software · frappe · reported by VulnCheckHigh 8.7
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.
Product
erpnext
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 12, 2026Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user.CVE-2026-78358 · Other software · OTRS GmbH (former OTRS AG) · reported by security@otrs.comMedium 4.3
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can therefore cause the browser of an authenticated administrator to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries. This may reduce the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed. Additional administrative endpoints were identified that do not validate a ChallengeToken. Some of these endpoints can trigger administrative actions such as deploying or synchronizing already existing configuration. They do not allow an attacker to introduce arbitrary new configuration through the CSRF request itself. Export and read-only endpoints were also identified without ChallengeToken validation. While these endpoints may be triggered through a forged cross-site
Product
OTRS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record otrs.com
Oct 11, 2026VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data.CVE-2026-108982 · Other software · IDRIX · reported by MITREHigh 7.2
VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.)
Product
VeraCrypt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 11, 2026Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs.CVE-2026-107761 · Other software · GitroomHQ · reported by 4cdc9741-f887-419a-a2fd-acbbd2729276Medium 5.3
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore receives that channel's social platform credentials and can use them against the connected account directly, outside Postiz. `GET /user/organizations` returns each organization row, including its API key, to every member of the organization. The API key is intended for admins only, so a member with a lower role can obtain it and call the public API on behalf of the organization. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization. There is no anonymous access and no cross-tenant exposure.
Product
postiz-app
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gadvisory.org github.com
Oct 11, 2026WP-Invoice: Does not perform capability checks in several of its AJAX handlersCVE-2026-97183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
Product
WP-Invoice
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update WP-Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Datalist it: Does not sanitize and escape several request parameters before using them to build a SQL queryCVE-2026-89285 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
Product
Datalist it
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update Datalist it to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Adwised Web Push Notification: Does not have authorisation checks on several state-changing operationsCVE-2026-87762 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.
Product
Adwised Web Push Notification
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update Adwised Web Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 11, 2026Fundiin cho WooCommerce: Does not have proper authorisation on several of its REST API routesCVE-2026-81649 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.
Product
Fundiin cho WooCommerce
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Fundiin cho WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 9, 2026In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functionsCVE-2026-108474 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.8
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
Product
Exposed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com
Oct 9, 2026ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games.CVE-2026-107839 · Other software · luskaner · reported by GitHubHigh 7.5
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the attacker-controlled JSON names array and allocates response storage directly from the unbounded array length. A remote unauthenticated client can use the default self-registration flow and send an oversized request that causes excessive memory allocation, crashes or hangs the server process, disconnects active players, and keeps the service unavailable until it is restarted. This issue is fixed in version 1.15.2.
Product
ageLANServer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 9, 2026SendPress Newsletters: Does not check the user's capability on several newsletter-management actionsCVE-2026-92989 · WordPress plugins & themes · reported by WPScanMedium 4.3
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.
Product
SendPress Newsletters
Affected
up to 1.26.1.20
What to do
Affects up to 1.26.1.20. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then wCVE-2026-97147 · Other software · OpenStack · reported by MITREHigh 7.2
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments. A project administrator can create a workbook whose embedded ad-hoc action or workflow name collides with a resource of another project, which moves that resource into the caller's project and causes the original owner's subsequent updates of it to fail with server errors. Only deployments exposing the Mistral API are affected.
Product
Mistral
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.net security.openstack.org
Oct 8, 2026Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the nCVE-2026-107581 · Other software · Progressive Robot Ltd · reported by cve@gitlab.comMedium 6.5
Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY[] section with a case-insensitive string replacement that copied the whole item per occurrence and split the item list by repeatedly copying the remainder of the command; the server's case-insensitive search compared a needle afresh at every position, so a long SEARCH TEXT key over a message cost the product of the two lengths; SEARCH message sets and the saved-result marker ($), SORT criteria, HEADER.FIELDS name lists and UID ranges were each read once per message rather than once per command; and a FETCH naming a message's sections very many times read and held every section in memory before sending any. An IMAP command may continue past one line through non-synchronizing literals, so one command can reach about eleven megabytes. The IMAP worker threads are a small pool shared with SMTP and POP3, so a signed-in user sending such commands can make the IMAP, SMTP and POP3 services stop respo
Product
hMailServer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Oct 8, 2026Appointment Booking: Does not enforce per-record authorization on several of its AI Abilities API actionsCVE-2026-105196 · WordPress plugins & themes · reported by WPScanLow 3.3
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.
Product
Appointment Booking
Fixed in
5.6.9
What to do
Update Appointment Booking to 5.6.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Image Photo Gallery Final Tiles Grid: Does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script blockCVE-2026-104646 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.
Product
Image Photo Gallery Final Tiles Grid
Fixed in
3.6.14
What to do
Update Image Photo Gallery Final Tiles Grid to 3.6.14 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026Image Photo Gallery Final Tiles Grid: Does not properly verify authorization on several of its gallery and image management actionsCVE-2026-104645 · WordPress plugins & themes · reported by WPScanLow 2.7
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.
Product
Image Photo Gallery Final Tiles Grid
Fixed in
3.6.14
What to do
Update Image Photo Gallery Final Tiles Grid to 3.6.14 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2026In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackersCVE-2023-5648 · Other software · Brocade · reported by sirt@brocade.comMedium 6.5
In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.
Product
Active Support Connectivity Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Oct 7, 2026Nexi XPay Build: Does not verify the payment result supplied to several of its unauthenticated routesCVE-2026-82211 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
Product
Nexi XPay Build
Affected
up to 7.6.2
What to do
Affects up to 7.6.2. Update Nexi XPay Build to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.