Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,641 results · page 1 of 53
Oct 29, 2026SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1.CVE-2026-96228 · WordPress plugins & themes · reported by WordfenceHigh 8.1
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordfence.com
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, CVE-2026-99185 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same transaction entry in the pending transaction list. The return value of timer_delete() is used to determine which function handles the entry. If the transaction is a split transaction and timer_delete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove. A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side. Fix the regression by ensuring that the response handler does not process the transaction when timer_delete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 27, 2026A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypteCVE-2026-103594 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Critical 9.5
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers.CVE-2026-111548 · Other software · Moxa · reported by psirt@moxa.comMedium 5.3
A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers. An authenticated remote attacker with low privileges could exploit insufficient bounds checking of user-supplied input, causing the web management service to become unresponsive. Restoring the service requires power cycling the affected device, while other device functions remain operational.
- Product
- NPort W2150A-W4/W2250A-W4 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate.CVE-2026-79977 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 8.2
The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram's source address into peer->endpoint with memcpy(&peer->endpoint, peer_addr, sizeof(peer->endpoint)). Because the receiver index is unknown, there is no key with which such a message could be verified, so the address written into peer->endpoint is entirely attacker-supplied. Every other endpoint update in the implementation happens only after authentication — after the Noise handshake in handle_handshake_init(), or after AEAD decryption plus the anti-replay check in wg_process_data_message(). The WireGuard listener is registered with net_udp_register() using no remote address or port filter and defaults to UDP port 51820 (CONFIG_WIREGUARD_PORT), and wg_ctrl_recv() resolves the peer by interface rather than by any cryptographic identity. Any host able to send a UDP datagram to that port can therefore reach the defect off-path, with no need to observe legitimate traffic: a 16-byte
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads beCVE-2026-99059 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.7
In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partway through, and during that slow calculation, or even while blocking on down_write(), A completes and then also a handshake initiation that's already been queued up runs in thread C, which itself takes that same down_write(). The handshake initiation creation succeeds, and sets the state back to waiting-for-response, and calls up_write(), at which point thread B resumes, because either its finished its calculations or was finally allowed to acquire down_write(). Thread B then copies the state back to the peer, and begins a new session, using that state, which is the same session as the one made in thread A. Thread A Thread B Thread C down_read() sA = handshake->state memcpy(cA, handshake->crypto) up_read() if (sA != 1) goto fail slow_crypto(cA) down_read() sB = handshake->state memcpy(cB, handshake->crypto) up_read() if (sB != 1) goto fail slow_cryp
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 22, 2026A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote codeCVE-2026-95704 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared CVE-2026-78066 · Websites & servers · Apache Software Foundation · reported by security@apache.org
Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared by the client or on decompressed output, which attackers can use to drive disproportionate memory use and crash the process. Root Cause: 1) The gzip/zlib/snappy decompressors enforce no output limit: -max_body_size is checked against the compressed bytes only, so a cap-compliant body (e.g. 64 MiB) can decompress to tens of GiB. 2) The AMF string readers allocate the declared length before the bytes are actually available. 3) RTMP chunk headers may re-declare a message length mid-stream; the declared length was never bounded and the partial reassembly buffer kept growing. 4) The sofa-pbrpc parser does not bound meta_size. 5) mcpack2pb trusts wire-declared item counts for Reserve() and a string value_size of 0 underflows the buffer size, aborting the process. Affected Scenarios: Any bRPC service accepting gzip/zlib/snappy-compressed bodies or rtmp, sofa-pbrpc, or mcpack2pb messages from untrusted clients. How to Fix:(Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply th
- Product
- Apache bRPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that CVE-2026-105941 · Other software · Red Hat · reported by Red HatHigh 8.1
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
- Product
- streams for Apache Kafka 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for iso_resource_auto client resource The todo member CVE-2026-98587 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for iso_resource_auto client resource The todo member of iso_resource_auto structure represents the state of the client resource and normally transitions in the following order: ISO_RES_AUTO_ALLOC -> ISO_RES_AUTO_REALLOC -> ISO_RES_AUTO_DEALLOC However, concurrent access from the work item and the file descriptor release function can cause the state to transition backwards from ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC. Prevent the back-transition by checking the current state before updating it in the work item.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 14, 2026When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 deCVE-2026-101338 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.CVE-2026-85829 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Double free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.CVE-2026-69798 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <CVE-2026-78799 · Other software · reported by MITRECritical 9.8
Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the editCVE-2026-109567 · Other software · zofe · reported by VulnCheckHigh 8.6
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
- Product
- rapyd-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_CVE-2026-109352 · Other software · librenms · reported by VulnCheckMedium 5.3
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device's SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device's Wireless tab, enabling session hijacking.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 9, 2026An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary coCVE-2026-78796 · Other software · reported by MITRECritical 9.8
An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\cgi-bin\upgrade file
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compastebin.com
Oct 9, 2026An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive infCVE-2026-78795 · Other software · reported by MITREHigh 7.5
An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key.CVE-2026-107785 · Other software · Sirius Computer, Inc. · reported by d0a6edd6-4b7d-45f2-a6f9-9b944f7b6132Medium 6.3
Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this size; instead it attempts to use the `wg set` command to update the live tunnel, and write the invalid key to the WireGuard configuration file. The update fails, so the live tunnel keeps using its previous preshared key until the tunnel is shut down. The tunnel will fail to start when restarted. For a peer which has never successfully negotiated a 32-byte bilocation key in a Crux C2 organization which has the "Enforce SKA Use" setting turned off, no preshared key will be set for the tunnel. Therefore, an attacker who is able to intercept and store the peer's traffic, and has access (or will have access) to a cryptographically relevant quantum computer, will be able to decrypt the tunnel.
- Product
- Crux Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s CVE-2026-102781 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_ajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser(), authorise(), or a CSRF token check exists anywhere in the handler. Two confirmed impact paths: an unauthenticated GET deletes any slider image by guessable sequential IDs, and an unauthenticated multipart upload with a zip file renames and replaces the entire #__os_touch_slider/#__os_touch_slider_text tables site-wide with attacker-supplied content, with no task parameter even required for the second path.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the CVE-2026-102169 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.1
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.
- Product
- Wi-Fi Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the CVE-2026-102168 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.1
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible.
- Product
- Wi-Fi Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints.CVE-2026-102167 · Other software · Arista Networks · reported by psirt@arista.comCritical 9
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.
- Product
- Wi-Fi Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associCVE-2026-102164 · Other software · Arista Networks · reported by psirt@arista.comLow 2.3
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.
- Product
- Wi-Fi Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can CVE-2026-102163 · Other software · Arista Networks · reported by psirt@arista.comHigh 8.7
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.
- Product
- Wi-Fi Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway servicCVE-2026-102162 · Other software · Arista Networks · reported by psirt@arista.comCritical 9.4
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.
- Product
- Wi-Fi Access Points
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with thCVE-2026-17507 · Other software · Legion of the Bouncy Castle Inc. · reported by 91579145-5d7b-4cc5-b925-a0262ff19630High 8.7
In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legitimate encoding rather than malformed input, and it must still decode, since the MLS interop test vectors round-trip the full range. GroupKeySet.SecretTree.hasLeaf and Group.validateRemove compared the decoded value directly against the tree's leaf count, and a signed comparison treats any negative int as less than a positive bound, so an out-of-range sender passed the membership check. In the hasLeaf case the SenderData of an unprotected PrivateMessage could then drive LeafIndex.directPath through NodeIndex.parent() arithmetic that never reaches the tree root, growing the resulting node list without bound until the JVM exhausted its heap. A single small message from any current group member could therefore deny service to every other member of the group. Both comparisons now interpret the value as unsigned via Integer.toUnsignedLong, rejecting an out-of-range sender however it was encoded; well-formed leaf indices are unaffected.
- Product
- BC-JAVA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen.CVE-2026-53605 · Other software · pollen-robotics · reported by GitHubHigh 7.8
Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.
- Product
- reachy-mini-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-96423 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-96422 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-96421 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-96420 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 4.7
Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code executionCVE-2026-96419 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-96418 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-96417 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-96416 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-96415 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-95395 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-95394 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 4.7
Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-95393 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 4.7
CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-95392 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of serviceCVE-2026-95391 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of serviceCVE-2026-95390 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-95389 · Other software · Wireshark Foundation · reported by cve@gitlab.comHigh 8.1
SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-95388 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serviceCVE-2026-95387 · Other software · Wireshark Foundation · reported by cve@gitlab.comHigh 8.1
SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 29, 2026TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of serviceCVE-2026-95386 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 5.5
TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comwireshark.org
Sep 25, 2026The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them.CVE-2025-1218 · Websites & servers · PHP Group · reported by security@php.netLow 3.4
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_cCVE-2026-93207 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_credbody() writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail. The caller storage is svcdata->clcred, which lives in the per-svc_rqst gss_svc_data and is reused across requests. Early decode failures leave partially decoded state mixed with residue from the prior request. The trailing body_len tightness check is the sharpest case: xdr_stream_decode_opaque_inline() has already written gc_ctx.data with a borrowed inline pointer into the current request's XDR pages, but gc_ctx.len retains its prior value. Once the request pages are released the pooled clcred carries a dangling pointer paired with a stale length. Zero the caller's rpc_gss_wire_cred at function entry so that every early-return path leaves a deterministic all-zero cred. On the trailing tightness-check path, gc_ctx.len is now zero instead of stale, which neuters length-driven consumers such as gss_svc_searchbyctx() that would otherwise walk the dangling data pointer.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 23, 2026Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java.CVE-2026-61695 · Other software · square · reported by GitHubHigh 7.5
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.
- Product
- wire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.