Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,869 results · page 1 of 138
Oct 28, 2026Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to vieCVE-2026-118754 · Other software · Dolibarr · reported by VulnCheckMedium 6.9
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
- Product
- Dolibarr ERP/CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view.CVE-2026-105619 · Other software · DALIBO · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 4.8
PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
- Product
- PostgreSQL Anonymizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion).CVE-2026-88858 · Other software · Grafana · reported by security@grafana.comMedium 6.5
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Rich Showcase for Google Reviews: Authorization bypassCVE-2026-110020 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve the plugin's 127-character site-wide grw_auth_code authentication secret and use it to impersonate the WordPress site to the RichPlugins backend service at app.richplugins.com.
- Product
- Rich Showcase for Google Reviews
- Affected
- up to 7.1.6
- What to do
- Affects up to 7.1.6. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddownloads.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2026Royal Addons for Elementor: Does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX actionCVE-2026-107100 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.
- Product
- Royal Addons for Elementor
- Fixed in
- 1.7.1070
- What to do
- Update Royal Addons for Elementor to 1.7.1070 or newer.
Oct 27, 2026GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key.CVE-2026-105272 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpLow 2.3
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outsideCVE-2026-118310 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comCritical 9.6
Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Oct 27, 2026The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint.CVE-2026-118171 · Other software · Strapi · reported by cret@cert.org
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
- Product
- Strapi Open Source and Enterprise Headless CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possCVE-2026-118170 · Other software · Strapi · reported by cret@cert.org
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
- Product
- Strapi Open Source and Enterprise Headless CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resCVE-2026-82984 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.3
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticaCVE-2026-92377 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.8
Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allowCVE-2026-92376 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.8
Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.
- Product
- Remote Management - Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management MonitoCVE-2026-92375 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.8
An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prCVE-2026-92374 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.8
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker tCVE-2026-92372 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 8.8
An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.8CVE-2026-111585 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 8.8
An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticatedCVE-2026-111584 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.3
A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.
- Product
- TeamViewer Remote - Patch Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of AdvCVE-2026-111583 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.3
Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker CVE-2026-111582 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.3
A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges. Exploitation requires user interaction.
- Product
- Remote Management - Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats.CVE-2026-104189 · Other software · maz1987in · reported by GitHubHigh 7.5
The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents even when the link share was protected by a password. `PublicFileController` extended `OCP\AppFramework\Controller` and marked its routes `#[PublicPage]`. Nextcloud only enforces share passwords through `PublicShareMiddleware`, which returns early for any controller that is not an `OCP\AppFramework\PublicShareController` instance — so no password, expiry, or share-type check ran for these routes. `ShareFileService::loadLinkShare()` compounded this by treating any token that `getShareByToken()` matched as authorised. A share token is the part of the URL that people paste into chats, emails, and tickets. Password protection exists precisely for the case where holding the token should not by itself grant access, and that guarantee did not hold. Requests to `GET /ocs/v2.php/apps/threedviewer/public/file/{token}/{fileId}` returned `200` with the full file body for password-protected shares, with
- Product
- 3Dviewer-Nextcloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API.CVE-2026-105987 · Other software · KGS Software · reported by cvd@cert.plMedium 5.1
KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session. This issue has been fixed in version 1.2.8.
- Product
- tia Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plkgs-software.com
Oct 27, 2026Sandbox escape due to use-after-free in the Print Preview component.CVE-2026-117971 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Advanced Views – Display Framework for Gutenberg & Elementor: Stored Cross-Site ScriptingCVE-2026-109995 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable even against pending or unapproved comments, as the plugin's get_comment() lookup applies no approval-status filter, meaning a payload executes for any visitor loading an avf-layout block bound to the attacker's comment ID before the comment is ever reviewed.
- Product
- Advanced Views – Display Framework for Gutenberg & Elementor
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update Advanced Views – Display Framework for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 27, 2026REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not cheCVE-2026-116897 · Other software · redaxo · reported by VulnCheckHigh 7.1
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding tCVE-2026-116820 · Other software · YesWiki · reported by VulnCheckMedium 6.9
YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attaCVE-2026-116746 · Other software · qloapps · reported by VulnCheckMedium 6.9
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_token and enumerate sequential id_order values to post fake ratings and reviews attributed to other customers.
- Product
- qloapps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2.CVE-2026-116477 · Other software · a2aproject · reported by VulDBMedium 5.3
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
- Product
- a2a-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3.CVE-2026-116476 · Other software · a2aproject · reported by VulDBMedium 5.3
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
- Product
- a2a-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A vulnerability was identified in FastStone Image Viewer up to 8.5.CVE-2026-116463 · Other software · FastStone · reported by VulDBMedium 5.3
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Image Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Photo Reviews for WooCommerce: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-111404 · WordPress plugins & themes · reported by PatchstackLow 3.7
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.31.
- Product
- Photo Reviews for WooCommerce
- Affected
- up to 1.2.31
- What to do
- Affects up to 1.2.31. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2026A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7.CVE-2026-115193 · Other software · reported by security@mautic.orgHigh 8.2
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Panorama Viewer – 360 Degree Image + Video Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115956 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: from n/a through 1.8.3.
- Product
- Panorama Viewer – 360 Degree Image + Video Viewer
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Panorama Viewer – 360 Degree Image + Video Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-55486 · Other software · intranda · reported by GitHubCritical 9.3
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-55465 · Other software · intranda · reported by GitHubMedium 5.3
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/{solrField}/spatial/search concatenates the user-supplied region query parameter directly into a Solr query string with no escaping, no local-param stripping, and no runtime schema enforcement (the OpenAPI @Schema(pattern=...) annotation is documentation-only at the JAX-RS layer). An attacker can inject Solr local-param syntax ({!parent ...}, {!join ...}) and boolean operators to make access-restricted georeferenced records match the query, bypassing the access-condition filter. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-55463 · Other software · intranda · reported by GitHubMedium 6.5
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-55459 · Other software · intranda · reported by GitHubHigh 7.4
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-55457 · Other software · intranda · reported by GitHubHigh 7.4
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-55444 · Other software · intranda · reported by GitHubMedium 5.3
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-55442 · Other software · intranda · reported by GitHubMedium 5.3
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy \{(.+)\} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-46652 · Other software · intranda · reported by GitHubCritical 9.8
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-46651 · Other software · intranda · reported by GitHubCritical 9.8
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-46347 · Other software · intranda · reported by GitHubMedium 6.8
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The Goobi viewer is a web application that allows digitised material to be displayed in a web browser.CVE-2026-46346 · Other software · intranda · reported by GitHubMedium 6.5
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.
- Product
- goobi-viewer-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static sCVE-2026-92450 · Other software · Kiloview · reported by ics-cert@hq.dhs.govHigh 8.7
The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.
- Product
- E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authenticaCVE-2026-110825 · Other software · Kiloview · reported by ics-cert@hq.dhs.govHigh 8.7
The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.
- Product
- E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations.CVE-2026-110491 · Other software · Kiloview · reported by ics-cert@hq.dhs.govMedium 6.9
The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.
- Product
- E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance addresCVE-2026-110243 · Other software · Kiloview · reported by ics-cert@hq.dhs.govCritical 9.4
The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.
- Product
- E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passingCVE-2026-107861 · Other software · Kiloview · reported by ics-cert@hq.dhs.govCritical 9.4
The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.
- Product
- E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively CVE-2026-96616 · Other software · Kiloview · reported by ics-cert@hq.dhs.govHigh 8.3
Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.
- Product
- E3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into tCVE-2026-111594 · Other software · InterSystems · reported by ics-cert@hq.dhs.govCritical 9.2
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
- Product
- IRIS for Health
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.intersystems.comdocs.intersystems.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.