Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Oct 27, 2026This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMCCVE-2026-65213 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Medium 6.6
This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.CVE-2026-65211 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411High 7.2
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.CVE-2026-65220 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411High 8.8
A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, whicCVE-2026-65219 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411High 7.4
A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI manaCVE-2026-65210 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Medium 4.9
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The HTML5 KVM-over-IP console authenticates with a token returned by the web interface.CVE-2026-18451 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Low 3.1
The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.
- Product
- MBD-X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The BMC does not correctly enforce integrity and encryption requirements for IPMI commands.CVE-2026-18450 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411Critical 9.8
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- Product
- X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026The BMC does not correctly enforce integrity and encryption requirements for IPMI commands.CVE-2026-18449 · Other software · SMCI · reported by def9a96e-e099-41a9-bfac-30fd4f82c411High 7.5
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- Product
- X12SPI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.