Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22,984 results · page 1 of 460
Oct 29, 2026This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the wCVE-2026-114358 · Other software · Radius Synergies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system.
- Product
- Radius Xenia M2M Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.CVE-2026-118905 · Other software · nvm-sh · reported by 7ffcee3d-2c14-4c3e-b844-86c6a321a158High 7.1
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the `e` command runs a shell command as the user; with BSD sed, the `w` and `r` commands write and read files. This is reachable whenever an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec`, or to `nvm-exec` via `NODE_VERSION`, and at least one version is installed. nvm's own `.nvmrc` parser strips comments, so a bare `nvm use` is not affected; however, the bash `cdnvm` and zsh `load-nvmrc` auto-switch hooks documented in the README read `.nvmrc` as-is and pass it to `nvm ls` and `nvm version`, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious `.nvmrc`; scripts that run `nvm use "$(cat .nvmrc)
- Product
- nvm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809).CVE-2026-42949 · Other software · frangoteam · reported by talos-cna@cisco.comMedium 5.6
A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
- Product
- Frangoteam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).CVE-2026-42922 · Other software · frangoteam · reported by talos-cna@cisco.comCritical 9.8
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
- Product
- Frangoteam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2026A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809).CVE-2026-40063 · Other software · frangoteam · reported by talos-cna@cisco.comMedium 5.3
A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
- Product
- Frangoteam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an aCVE-2026-66088 · Other software · Apereo Foundation · reported by 9c1820ae-fb77-4810-a8aa-ca46e7474d2fCritical 9.4
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
- Product
- openEQUELLA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenequella.github.io
Oct 28, 2026An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function.CVE-2026-109411 · Other software · Samba · reported by Red HatHigh 8.1
An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comattachments.samba.org
Oct 28, 2026PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions.CVE-2026-110182 · Other software · DALIBO · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 4.3
PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
- Product
- PostgreSQL Anonymizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies.CVE-2026-110181 · Other software · DALIBO · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 6.5
PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
- Product
- PostgreSQL Anonymizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to provide a small image wCVE-2026-105614 · Other software · DALIBO · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 4.7
PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to provide a small image with enormous declared dimensions. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
- Product
- PostgreSQL Anonymizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size.CVE-2026-105613 · Other software · DALIBO · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 4.7
PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
- Product
- PostgreSQL Anonymizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability.CVE-2026-118606 · Other software · Alpine · reported by zdi-disclosures@trendmicro.comHigh 8.8
Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the framework service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29006.
- Product
- iLX-F511
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtainCVE-2026-103409 · Network & remote access · Juniper Networks · reported by sirt@juniper.netCritical 9.8
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
- Product
- Session Smart Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportportal.juniper.net
Oct 28, 2026Functype is a family of TypeScript functional programming libraries.CVE-2026-59176 · Other software · jordanburke · reported by GitHubHigh 7.8
Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/mcp-server/src/index.ts` and interpolates it into `functype@<version>` for `pnpm add`. Package-alias syntaxes such as `file:`, `npm:`, URLs, or paths can cause an arbitrary local or remote package to be installed as functype. Immediately afterward, `initDocsData(true)` in `packages/mcp-server/src/lib/docs/data.ts` resolves `functype/cli` and dynamically imports the newly installed module, executing attacker-controlled JavaScript with the MCP server process's privileges. Any MCP client able to send a `tools/call` request invoking the tool can exploit the flaw; the tool is enabled by default without authentication in `stdio` mode. A connected AI assistant susceptible to indirect prompt injection can also be induced to invoke it from a malicious document or web page. In non-default `TRANSPORT_TYPE=httpStream` deployments, a network-accessible attacker does not require local access. Successful execution can read process secrets, modify files, or terminat
- Product
- functype
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocate_usb4_bandwCVE-2026-99151 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both use ASSERT(stream->sink) before dereferencing stream->sink->link. ASSERT is compiled out in production builds, so a NULL stream->sink causes a NULL pointer dereference. link_set_dpms_off() already guards two earlier accesses to stream->sink with explicit NULL checks, confirming that stream->sink can legitimately be NULL. The subsequent call to deallocate_usb4_bandwidth() had no equivalent guard. Replace the ASSERT() calls with proper NULL checks that return false early, and add a matching stream->sink guard at the call site in link_set_dpms_off() consistent with the surrounding pattern. v2: Keep the existing ASSERT() calls for diagnostics (to report unexpected NULL sink), and add explicit NULL checks that return false before dereferencing stream->sink. Also add a matching stream->sink guard at the deallocation call site in link_set_dpms_off(). (Alex) (cherry picked from commit 98029a0ce61feb52c563f65349dd9b25f672e355)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print_graph_function_event() tracing_set_tracer() assigns the flags CVE-2026-99141 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print_graph_function_event() tracing_set_tracer() assigns the flags of the newly selected tracer with: tr->current_trace_flags = t->flags ? : t->tracer->flags; If the new tracer defines neither static flags nor default flags, like hwlat, irqsoff or wakeup, add_tracer() has no per instance flags copy for it, and both operands are NULL, so tr->current_trace_flags ends up being NULL as well. The ring buffer is not cleared when switching tracers: it is reset inside tracer_init(), after current_trace_flags was already assigned. If the buffer still holds function_graph entries of the previous tracer, printing one of them dereferences the NULL pointer. This was hit by cat trace during an ftrace stress test: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode RIP: 0010:print_graph_function_event+0xe/0x20 Call Trace: s_show+0x4d/0x110 seq_read_iter+0x2d4/0x490 seq_read+0x130/0x170 vfs_read+0xb5/0x370 ksys_read+0x6d/0xe0 do_syscall_64+0xbc/0x450 The snapshot buffer is not reset at all, so this can be reproduced with
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpc_validate_xid() function sets grp->saved_xiCVE-2026-99126 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp->saved_xid2 is never initialized. An attempt to set the flag in such case leads to NULL dereference. Fix this by using the always available priv->xid->xid2_flag2 instead of grp->saved_xid2->xid2_flag2 for validation errors.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service.CVE-2026-112197 · Other software · Tactis · reported by cve-coordination@incibe.esCritical 9.4
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
- Product
- NoviGest Desktop App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peerCVE-2026-118375 · Other software · ggml-org · reported by VulnCheckCritical 9.2
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.
- Product
- llama.cpp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated requeCVE-2026-118371 · Other software · OpenBSD · reported by VulnCheckMedium 6.3
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
- Product
- LibreSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.openbsd.orggithub.com
Oct 27, 2026GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key.CVE-2026-105272 · Other software · GROWI, Inc. · reported by vultures@jpcert.or.jpLow 2.3
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.
- Product
- GROWI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3.CVE-2026-102813 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.1
An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password. Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.
- Product
- RE305 v3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 27, 2026A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst beforeCVE-2026-109088 · Other software · X.org · reported by meissner@suse.deMedium 6.5
A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.
- Product
- libXtst
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.freedesktop.org
Oct 27, 2026Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly ConstraineCVE-2026-16307 · Other software · Netiket Information Technologies · reported by iletisim@usom.gov.trMedium 4.3
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
- Product
- EdoWEB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count.CVE-2026-117555 · Other software · GreycLab · reported by VulnCheckMedium 6.9
CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.
- Product
- CImg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality CVE-2026-65119 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.4
NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial of service.
- Product
- TensorRT-LLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Oct 27, 2026In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`CVE-2026-115408 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.5
In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never verify it against the private key. In addition, the "ID only" fallback search runs even when the private key has no `CKA_ID`, so the search template reduces to the public-key class and the ML-KEM key type and the first ML-KEM public key on the token is returned. `Encapsulate()` on the resulting key pair encrypts the fresh shared secret to that key, so its owner — not the holder of the private key the caller looked up — can recover the secret. An attacker who can open an unauthenticated session on the token and plant a public `CKK_ML_KEM` object carrying the victim's `CKA_ID`/`CKA_LABEL` receives the shared secrets for encapsulations performed through the substituted key pair, compromising the confidentiality of those secrets and of everything protected by keys derived from them. The v1 module paths have no ML-KEM support and are not affected.
- Product
- Eclipse KeyPont
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an eCVE-2026-117538 · Other software · redaxo · reported by VulnCheckLow 2.1
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 27, 2026REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages wCVE-2026-116893 · Other software · redaxo · reported by VulnCheckMedium 6.1
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Missing Authentication for Critical Function Vulnerability in HiRDB.CVE-2026-82116 · Other software · Hitachi · reported by hirt@hitachi.co.jpCritical 9.8
Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 9(32): from 09-02 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-00 through 09-66-/V.
- Product
- HiRDB Server Version 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers CVE-2026-116841 · Other software · diasurgical · reported by VulnCheckMedium 6.8
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can place a crafted .mpq archive in the game's data path, such as a mod, to trigger reads past mpq_map and crash the game.
- Product
- DevilutionX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated adminiCVE-2026-116827 · Other software · YesWiki · reported by VulnCheckHigh 8.2
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded outpuCVE-2026-116739 · Other software · kisli · reported by VulnCheckMedium 5.3
VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
- Product
- vmime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crCVE-2026-116738 · Other software · kisli · reported by VulnCheckHigh 8.7
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.
- Product
- vmime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead codeCVE-2026-116734 · Other software · dvidelabs · reported by VulnCheckMedium 6.3
flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process.
- Product
- flatcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM The probe function puts tCVE-2026-99089 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM The probe function puts the device into the runtime PM active state with only the "iis" bus clock enabled, but it also sets priv->op_clk to the parent of the RCLK_SRC mux without enabling it. The runtime PM suspend callback disables both clocks, so the first runtime suspend after probe disables op_clk once more than it was enabled. On Exynos5250 Arndale both clocks resolve to the same EXYNOS_I2S_BUS gate, so this triggers the following warning during boot: WARNING: drivers/clk/clk.c:1270 at clk_core_disable+0xe4/0x23c, CPU#0: kworker/u8:3/45 i2s_bus already disabled ... Workqueue: pm pm_runtime_work Call trace: ... clk_core_disable from clk_disable+0x28/0x34 clk_disable from i2s_runtime_suspend+0x58/0x68 [snd_soc_i2s] i2s_runtime_suspend [snd_soc_i2s] from genpd_runtime_suspend+0xc4/0x298 genpd_runtime_suspend from __rpm_callback+0x48/0x18c __rpm_callback from rpm_callback+0x4c/0x50 rpm_callback from rpm_suspend+0xf4/0x718 rpm_suspend from pm_runtime_work+0x9c/0xa0 ... Fix this by enabling op_clk in probe right after gettin
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 26, 2026boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py.CVE-2026-77059 · Other software · boneIO · reported by cvd@cert.plHigh 8.8
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges. A local attacker can exploit the race window between validation and installation to substitute malicious content, or use the predictable filename for symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root. This issue was fixed in version 1.6.0.
- Product
- boneIO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path afterCVE-2026-116195 · Other software · rclone · reported by VulnCheckHigh 7
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.
- Product
- rclone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 23, 2026Postiz lets a signed-in user ask the backend to run a function on one of their connected channels.CVE-2026-115931 · Other software · GitroomHQ · reported by 4cdc9741-f887-419a-a2fd-acbbd2729276Critical 9.9
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
- Product
- postiz-app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgadvisory.orggithub.com
Oct 23, 2026Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions.CVE-2026-115897 · Other software · yahoo · reported by GitHubLow 2.1
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.
- Product
- serialize-javascript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().CVE-2026-105482 · Other software · nodejs · reported by support@hackerone.comHigh 7.4
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Product
- node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.CVE-2026-106765 · Other software · reported by MITREHigh 7.5
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstillosdigitalholdings.com
Oct 23, 2026An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.CVE-2026-106764 · Other software · reported by MITREHigh 7.5
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstillosdigitalholdings.com
Oct 23, 2026An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.CVE-2026-106763 · Other software · reported by MITREHigh 7.5
An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstillosdigitalholdings.com
Oct 23, 2026An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with CVE-2026-115785 · Email & office · Zimbra · reported by cve@rapid7.comMedium 4.3
An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comrapid7.com
Oct 23, 2026Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an aCVE-2026-114357 · Other software · DJI · reported by vulnerability@ncsc.chCritical 9.3
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
- Product
- CrystalSky ZS600C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-defence-campus.github.io
Oct 23, 2026Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android alCVE-2026-114353 · Other software · DJI · reported by vulnerability@ncsc.chHigh 7
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
- Product
- CrystalSky ZS600C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyber-defence-campus.github.io
Oct 23, 2026`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache.CVE-2026-89313 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
- Product
- Eclipse KeyPont - GOSE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content.CVE-2025-30045 · Other software · CGM · reported by cvd@cert.plHigh 8.6
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path.CVE-2025-30043 · Other software · CGM · reported by cvd@cert.plHigh 7.1
CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. This issue was fixed in version 2026.MS3
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.