Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
746 results · page 1 of 15
Oct 26, 2026Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O commCVE-2026-88781 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 6.8
Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to subsequent system information being tampered with or causing a system crash. Refer to the 'Security Update for Multiple ASUS Motherboards' section on the ASUS Security Advisory for more information.
- Product
- motherboards firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archiveCVE-2026-116842 · Other software · diasurgical · reported by VulnCheckMedium 6.9
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its hash table count, causing memcpy to overflow the heap during startup and crash the game.
- Product
- DevilutionX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers CVE-2026-116841 · Other software · diasurgical · reported by VulnCheckMedium 6.8
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
- Product
- DevilutionX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling tCVE-2026-93489 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.7
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow aCVE-2026-75779 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.6
Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges CVE-2026-75775 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 7.7
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulatingCVE-2024-58396 · Other software · YouDataSum · reported by VulnCheckHigh 8.7
YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-01-13.
- Product
- CPAS Audit Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing CVE-2026-75753 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.3
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal conditions, it may be unable to perform self-recovery. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial oCVE-2026-17518 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.2
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations and cause a denial of service via an HTTP request with input exceeding the expected length. Refer to the ' Security Update for ASUS Router Firmware' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of aCVE-2026-102438 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.5
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2026In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an abCVE-2026-98475 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schib_config and schib fields as dma64_t to enable automatic detection of incorrect assignments. Also add the missing virt_to_dma64() translation. Without this fix, a wrong address will be used by firmware when storing extended format channel measurement data on kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 15, 2026Flexible Quantity – Measurement Price Calculator for WooCommerce: Missing AuthorizationCVE-2026-110364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.23.
- Product
- Flexible Quantity – Measurement Price Calculator for WooCommerce
- Affected
- up to 2.3.23
- What to do
- Affects up to 2.3.23. Update Flexible Quantity – Measurement Price Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POSCVE-2026-110770 · Other software · databasus · reported by VulnCheckCritical 9.2
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators.
- Product
- databasus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-basCVE-2026-102070 · Network & remote access · Juniper Networks · reported by sirt@juniper.netCritical 9.2
A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 12, 2026Flexible Quantity – Measurement Price Calculator for WooCommerce: Improper Validation of Specified Quantity in InputCVE-2026-106605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.
- Product
- Flexible Quantity – Measurement Price Calculator for WooCommerce
- Affected
- up to 2.3.22
- What to do
- Affects up to 2.3.22. Update Flexible Quantity – Measurement Price Calculator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Web Vitals Tracking: Does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative pageCVE-2026-87760 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.
- Product
- Web Vitals Tracking
- Affected
- up to 5.4.2
- What to do
- Affects up to 5.4.2. Update Web Vitals Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c that allows remote unauthenticCVE-2026-108102 · Other software · open5gs · reported by VulnCheckMedium 6.9
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags Volume Measurement IE, reading up to 48 bytes and potentially crashing the SMF.
- Product
- open5gs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Ocean Pro Demos and Ocean eComm Treasure Box: Stored Cross-Site ScriptingCVE-2026-81929 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display. A valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display are required.
- Product
- Ocean Pro Demos and Ocean eComm Treasure Box
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Ocean Pro Demos and Ocean eComm Treasure Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.oceanwp.orgdocs.oceanwp.org
Oct 6, 2026Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, moCVE-2026-14911 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.3
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearbCVE-2026-19396 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 7.7
A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing session.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload tCVE-2026-19386 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.3
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the systemCVE-2026-16528 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.4
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system.CVE-2026-105324 · Network & remote access · ASUSTOR Inc. · reported by security@asustor.comCritical 9.2
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.
- Product
- ADM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted deCVE-2026-93495 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 7
Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the ' Security Update for Multiple ASUS Motherboards ' section on the ASUS Security Advisory for more information.
- Product
- Motherboard(PRIME Z390-A )
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploCVE-2026-14157 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 9.4
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2026An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms aCVE-2026-13313 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 8.9
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
- Product
- Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients.CVE-2026-55157 · Other software · ooples · reported by GitHubHigh 8.4
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. The commands execute with the privileges of the user running the token-optimizer-mcp server. This issue has been patched in version 5.1.0.
- Product
- token-optimizer-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients.CVE-2026-55156 · Other software · ooples · reported by GitHubMedium 5.3
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication middleware — any network-accessible client can reach them without credentials. Both handlers concatenate the caller-supplied sessionId query parameter directly into a filesystem path via path.join, and Node.js normalizes .. segments at resolution time, allowing an unauthenticated attacker to read any .jsonl file reachable from the server's filesystem. This issue has been patched in version 5.1.0.
- Product
- token-optimizer-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken whCVE-2026-97540 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usb_device_id parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. Instead of keeping a side table for additional information, use driver_info field of the usb_device_id. The dynamic ID parsing code needs to be updated for this; convert it to just write to the reserved entry for dynamic ID and remove the weird loop.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 25, 2026In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_rog_ryujin) Validate HID report lengths rog_ryujin_raw_event() parses responsCVE-2026-97538 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_rog_ryujin) Validate HID report lengths rog_ryujin_raw_event() parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consume uninitialized bytes from the HID transport buffer and expose them as sensor values through sysfs. Validate the response header and the fields used by each response type before parsing them.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 24, 2026LaSuite Doc is a collaborative note taking, wiki and documentation platform.CVE-2026-76907 · Other software · suitenumerique · reported by GitHubMedium 6.5
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0.
- Product
- docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver CVE-2026-93124 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wireless: Fail probe when there is no ACPI match Every platform driver can be forced to match a device that does not match its list of device IDs because of device_match_driver_override(), so platform drivers that rely on the existence of a device ACPI companion object need to verify its presence. asus_wireless_probe() returns success when acpi_match_acpi_device() finds no match, leaving behind an input device that never reports anything because the notify handler is not installed. Worse, when the driver is force-bound to a device without an ACPI companion, probe still succeeds and stores a NULL companion pointer, which asus_wireless_remove() later passes to acpi_dev_remove_notify_handler(), leading to a NULL pointer dereference on unbind. Return -ENODEV when the device does not match the ID table. This also covers the missing-companion case, because acpi_match_acpi_device() rejects a NULL device. Perform the check before allocating any driver state, instead of after the input device has already been registered.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 17, 2026In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: fix resource leaks on probe failure During driver initialization iCVE-2026-93116 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7
In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: fix resource leaks on probe failure During driver initialization in asus_wmi_add(), various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration sequence. Specifically: 1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to fail_custom_fan_curve. Because this label is placed below fail_sysfs, it bypasses the cleanup calls for the input device and sysfs groups, which were successfully registered before, leaking those resources. 2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad. Because fail_screenpad is placed below fail_backlight, it bypasses the cleanup calls for backlight and rfkill, leaking those resources. Fix these resource leaks by reordering the error path labels in asus_wmi_add() to match the exact reverse order of the resource allocations.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 17, 2026In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found wCVE-2026-90331 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: HID: asus: refactor the two workqueues and init sequence Multiple issues have been found within the hid-asus driver: - unchecked size in asus_raw_event() - unclean teardown of asus_probe on failure - possible use-after-free in asus_probe - multiple workqueue used for jobs where one was enough - sleeping calls in atomic context - packets of incorrect size being sent to the keyboard controller Join the two workqueues into one reusing the stopping mechanism of the brightness workqueue, use the joined workqueue to also move the asus_wmi_send_event() sleeping call away from atomic context and add a size check in asus_raw_event().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 11, 2026Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.CVE-2026-62136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.
- Affected
- up to 2.3.21
- What to do
- Affects up to 2.3.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 7, 2026Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify hardware configuration settings and potentiCVE-2026-75811 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.8
Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify hardware configuration settings and potentially cause hardware damage by bypassing driver authentication and accessing critical model-specific registers.Refer to the ' Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing driver authentication and sending requeCVE-2026-75810 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.7
Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing driver authentication and sending requests to trigger system management interrupts (SMIs). Repeatedly triggering SMI may lead to a denial-of-service (DoS) condition.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassiCVE-2026-75809 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.9
Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exhaCVE-2026-75808 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.7
Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exhaustion by bypassing driver authentication and allocating an unrestricted amount of memory.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct conneCVE-2026-19397 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1High 7.7
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session. Refer to the ' Security Update for ASUS Control Center Express Agent ' section on the ASUS Security Advisory for more information.
- Product
- Control Center Express Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitializedCVE-2026-18023 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.7
Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a CVE-2026-16006 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driverCVE-2026-16005 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.8
Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (BSOD).Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted CVE-2026-16004 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.9
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification. Refer to the ' Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via CVE-2026-16003 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Low 2
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request by bypassing the driver's verification.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the userCVE-2026-12962 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 5.3
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application's local service endpoint.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
- Product
- Armoury Crate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_devCVE-2026-80774 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB parent. Fix the use of to_usb_interface() without a hid_is_usb() check. I have verified that it is currently possible to trigger a kernel splat due to this bug in an ASAN build, and that this commit fixes the issue.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 3, 2026Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorizedCVE-2026-75754 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Critical 10
Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company. Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.
- Product
- Control Center Enterprise (ACC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before accessing element atk_ec_present() walks CVE-2026-80593 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count before accessing element atk_ec_present() walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element: id = &obj->package.elements[0]; if (id->type != ACPI_TYPE_INTEGER) without checking that the sub-package is non-empty. ACPICA allocates the element array with exactly package.count entries, so for a sub-package with a zero count this reads past the allocation. The sibling function atk_debugfs_ggrp_open() performs the same access but skips empty packages with a package.count check first. Add the same check to atk_ec_present() so a malformed firmware package cannot trigger an out-of-bounds read.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 26, 2026An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corruptiCVE-2026-19398 · Network & remote access · ASUS · reported by 54bf65a7-a193-42d2-b1ba-8e150d3c35e1Medium 6.8
An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corruption via a crafted software SMI (SW SMI) request with an oversized length value.Refer to the ' Security Update for ASUS FA507NV / FA507NU BIOS ' section on the ASUS Security Advisory for more information.
- Product
- FA507NV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.