Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
206 results · page 1 of 5
Oct 30, 2026A flaw was found in the Kroxylicious ACL authorizer.CVE-2026-118952 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail to check a broader matching rule when prefixes overlap. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read a topic) that should be denied.
- Product
- streams for Apache Kafka 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 21, 2026MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replayiCVE-2026-89035 · Network & remote access · MikroTik · reported by VulnCheckCritical 9.1
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09.CVE-2026-113738 · Other software · R6410418 · reported by VulDBLow 2.1
A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py of the component MTP weight_map Handler. The manipulation of the argument shard_name leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Jackrong-llm-finetuning-guide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09.CVE-2026-113737 · Other software · R6410418 · reported by VulDBLow 2
A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This affects the function validate_indexed_tensors of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py. Executing a manipulation of the argument weight_map can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Jackrong-llm-finetuning-guide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that CVE-2026-105941 · Other software · Red Hat · reported by Red HatHigh 8.1
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.
- Product
- streams for Apache Kafka 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 19, 2026A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8.CVE-2026-112158 · Network & remote access · MikroTik · reported by VulDBHigh 7.1
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a loCVE-2026-103903 · Network & remote access · MikroTik · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.7
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a different existing account. The stage-one EC-SRP challenge and proof are verified using the attacker's account, while the independently supplied stage-two username is used to install the target account's privileges. By specifying a higher-privilege account such as admin, a low-privilege user can obtain a full administrative session without knowing the target account's password and can use that session to increase the privileges of the attacker's own account.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unCVE-2026-98318 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying the target and calculating the print name length. For "/ab", this causes two failures: sym[5] and path[5] are written past their allocations, and plen -= 2 * poff subtracts an assumed 8-byte prefix from a 6-byte UTF-16 target, wrapping u16 plen to 65534. That underflow causes another overflow: memcpy() copies 65534 bytes into a 24-byte buffer. A user with write access to a mounted share can trigger these bugs with default settings. Validate the NT drive prefix, including an ASCII drive letter, before accessing fixed offsets or subtracting the prefix length.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 2, 2026The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authenticationCVE-2026-84411 · Network & remote access · MikroTik · reported by ics-cert@hq.dhs.govCritical 9.3
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commikrotik.com
Sep 22, 2026MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an CVE-2026-93345 · Network & remote access · MikroTik · reported by VulnCheckHigh 8.7
MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with a negative-length address portion. Attackers can repeatedly send a single BGP UPDATE packet carrying a VPNv4 or VPNv6 NLRI with an out-of-bounds prefix-length to indefinitely hold down the BGP plane, causing session termination without a NOTIFICATION and triggering a service malfunction on the device. The fix is carried only in 7.25beta4, a development build; the current stable release 7.24.2 and the current long-term release 7.23.5 both remain affected.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.mikrotik.comvulncheck.com
Sep 16, 2026MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage.CVE-2025-56566 · Other software · reported by MITREMedium 4.6
MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump, without authenticating to the device and without knowledge of the administrative password.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns.CVE-2026-84993 · Other software · mikro-orm · reported by GitHubMedium 6.5
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validates the field key of an orderBy clause but does not validate its direction value before AbstractSqlPlatform.getOrderByExpression concatenates it into an ORDER BY clause. Applications that bind attacker-controlled request data to the direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() can permit a raw SQL fragment that performs blind or boolean extraction of data available to the database account. The BaseMySqlPlatform and MsSqlPlatform fallthrough paths have the same behavior, affecting SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers, while MongoDB is not affected. This issue is fixed in versions 6.6.16 and 7.1.7.
- Product
- mikro-orm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap CVE-2026-89028 · Network & remote access · MikroTik · reported by VulnCheckHigh 8.2
MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.mikrotik.comvulncheck.com
Sep 16, 2026MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the CVE-2026-56719 · Network & remote access · MikroTik · reported by VulnCheckMedium 6.3
MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read occurs in the SessionSetupAndX handler before any credential validation, potentially exposing sensitive memory contents.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.mikrotik.comvulncheck.com
Sep 14, 2026MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files oCVE-2026-89021 · Network & remote access · MikroTik · reported by VulnCheckMedium 6.9
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit unsanitized tar member path extraction during container import via /container/add to achieve root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without ever starting the container. The 7.23.x long-term branch does not contain this fix; the container binaries in container-7.23.3.npk and container-7.23.4.npk are byte-identical. The vendor has confirmed that the issue is not resolved in the long-term release and that the fix is carried forward only in the stable branch from 7.24.2 onward, with no backport to the long-term branch planned.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.mikrotik.comvulncheck.com
Sep 14, 2026MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder funcCVE-2026-89020 · Network & remote access · MikroTik · reported by VulnCheckMedium 5.3
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.mikrotik.comforum.mikrotik.com
Sep 5, 2026MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command VulnerabilityCVE-2026-86060 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedCritical 9.2
MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.
- Product
- RouterOS
- On CISA’s list since
- Sep 10, 2026 (federal fix deadline Sep 13, 2026)
- What to do
- Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcert.plcert.pl
Sep 5, 2026RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principalCVE-2026-67281 · Network & remote access · Mikrotik · reported by cvd@cert.plHigh 8.7
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityCVE-2026-67279 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedMedium 6.9
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.
- Product
- RouterOS
- On CISA’s list since
- Sep 25, 2026 (federal fix deadline Sep 28, 2026)
- What to do
- Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcert.plcert.pl
Sep 5, 2026MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authenticaCVE-2026-67278 · Network & remote access · Mikrotik · reported by cvd@cert.plMedium 6.3
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2026MikroTik RouterOS Missing Authentication for Critical Function VulnerabilityCVE-2026-67277 · Network & remote access · MikroTik · reported by cvd@cert.plExploitedHigh 8.8
MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
- Product
- RouterOS
- On CISA’s list since
- Sep 10, 2026 (federal fix deadline Sep 13, 2026)
- What to do
- Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcert.plcert.pl
Sep 5, 2026RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus bCVE-2026-67276 · Network & remote access · Mikrotik · reported by cvd@cert.plCritical 9.2
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange.CVE-2026-19278 · Other software · Red Hat · reported by Red HatMedium 6.8
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect (OIDC) token, whose claim value is a superstring of a configured pattern, to gain unauthorized access to roles they were not intended to receive. This can lead to privilege escalation within the system.
- Product
- Red Hat Advanced Cluster Security 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 5, 2026dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing.CVE-2026-71261 · Other software · mackron · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.8
dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.
- Product
- dr_libs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability.CVE-2026-14227 · Network & remote access · MikroTik · reported by ics-cert@hq.dhs.govMedium 6.9
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts.CVE-2026-16347 · Network & remote access · MikroTik · reported by ics-cert@hq.dhs.govHigh 8.7
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: <= 1.34).CVE-2026-15812 · Other software · Red Hat · reported by Red HatMedium 4.8
A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: <= 1.34). When the framework is explicitly configured to manage dynamic links (accepting network traffic from any IP address) without network payload encryption, the validation architecture implicitly trusts the link ID provided within incoming data packets. A remote, unauthenticated attacker can exploit this lack of validation by spoofing a legitimate link ID inside crafted network frames. This allows the attacker to fully bypass the ACL framework and inject arbitrary data packets into the application layer, potentially leading to data corruption or service instabilities.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 21, 2026A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management.CVE-2026-15811 · Other software · Red Hat · reported by Red HatMedium 5.8
A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after the associated structures are freed. A local attacker capable of leveraging memory disclosure techniques could exploit this flaw to retrieve the active encryption key, allowing them to decrypt cluster network communications or inject malicious packets to cause severe high-availability cluster instability.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 20, 2026A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34).CVE-2026-15813 · Other software · Red Hat · reported by Red HatMedium 6.5
A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can exploit this lack of verification by transmitting malformed packets with corrupted sequence parameters. Under specific conditions, this forces the packet processing layer to parse data outside the designated bounds of the internal memory structures, causing an out-of-bounds memory access or heap corruption. This behavior can result in sudden application crashes or system instability.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jul 13, 2026An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service vCVE-2026-39042 · Other software · reported by MITREHigh 7.5
An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmikrotik.comzakpatrik.cz
May 26, 2026FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin.CVE-2026-48695 · Other software · Pavel-odintsov · reported by MITREHigh 8.1
FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() function in src/mikrotik_plugin/fastnetmon_mikrotik.php (lines 107-108) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo `date` \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). This is identical in pattern to the Juniper plugin vulnerability. The $msg variable contains unsanitized attack data from command-line arguments. An attacker who can influence argv[] values can inject arbitrary shell commands. The fix is to replace exec() with file_put_contents() or use escapeshellarg().
- Product
- Fastnetmon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns.CVE-2026-44680 · Other software · mikro-orm · reported by GitHubHigh 7.6
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, MikroORM's identifier-quoting helper (Platform.quoteIdentifier and the postgres/mssql overrides) and its JSON-path emitters (Platform.getSearchJsonPropertyKey, quoteJsonKey) did not properly escape characters that delimit the SQL identifier or string-literal context they emit into. When application code passes attacker-influenced strings to public ORM APIs that expect an identifier or a JSON-property filter, an attacker can break out of the quoted context and inject arbitrary SQL. This vulnerability is fixed in @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14.
- Product
- mikro-orm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows.CVE-2026-41070 · Other software · jkroepke · reported by GitHubCritical 10
openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.
- Product
- openvpn-auth-oauth2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the CVE-2024-27686 · Other software · reported by MITREHigh 7.5
Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 5, 2026RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communicationsCVE-2025-42611 · Network & remote access · Mikrotik · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 6.5
RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others. The vulnerability lies in shared certificate validation logic which uses the system certificate store that is shared and equally trusted by all system services. This causes confusion of scope, allowing any certificate authority present in the system-wide trust store to be trusted in any context (with some exceptions), allowing partial or full authentication bypass in CAPsMAN, OpenVPN, Dot1X and potentially others.
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2026A vulnerability was identified in MikroTik RouterOS 6.49.8.CVE-2026-7668 · Network & remote access · MikroTik · reported by VulDBMedium 5.5
A vulnerability was identified in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the component SCEP Endpoint. The manipulation of the argument transactionID/messageType leads to out-of-bounds read. The attack may be initiated remotely. The exploit is publicly available and might be used. You should upgrade the affected component. The vendor recommends to "use the latest v6.x or 7.x MikroTik RouterOS version, the reported issue should be fixed there."
- Product
- RouterOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns.CVE-2026-34221 · Other software · mikro-orm · reported by GitHubHigh 8.3
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object structures. The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype when merged. This issue has been patched in versions 6.6.10 and 7.0.6.
- Product
- mikro-orm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns.CVE-2026-34220 · Other software · mikro-orm · reported by GitHubCritical 9.3
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This issue has been patched in versions 6.6.10 and 7.0.6.
- Product
- mikro-orm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser thaCVE-2026-32837 · Other software · mackron · reported by VulnCheckMedium 5.1
miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers can exploit improper null-termination handling in the coding history field to cause out-of-bounds reads past the allocated metadata pool, resulting in application crashes or denial of service.
- Product
- miniaudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac_CVE-2026-32836 · Other software · mackron · reported by VulnCheckMedium 6.9
dr_libs dr_flac.h version 0.13.3 and earlier (fixed in commits fefced4, 4f5a4cd, and 663239a) contain an uncontrolled memory allocation vulnerability in drflac__read_and_decode_metadata() that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can exploit attacker-controlled mimeLength and descriptionLength fields to cause denial of service through memory exhaustion when processing FLAC streams with metadata callbacks.
- Product
- dr_libs dr_flac.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion (LFI) vulnerability in the /server/node_upgrade_srv.js endpoint.CVE-2026-29522 · Other software · ZwickRoell GmbH & Co. KG · reported by VulnCheckHigh 8.7
ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion (LFI) vulnerability in the /server/node_upgrade_srv.js endpoint. An unauthenticated attacker can supply directory traversal sequences via the firmware parameter to access arbitrary files on the server, leading to information disclosure of sensitive system files.
- Product
- Test Data Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comzwickroell.com
Mar 3, 2026dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() funCVE-2026-29022 · Other software · mackron · reported by VulnCheckMedium 6.8
dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) contain a heap buffer overflow vulnerability in the drwav__read_smpl_to_metadata_obj() function of dr_wav.h that allows memory corruption via crafted WAV files. Attackers can exploit a mismatch between sampleLoopCount validation in pass 1 and unconditional processing in pass 2 to overflow heap allocations with 36 bytes of attacker-controlled data through any drwav_init_*_with_metadata() call on untrusted input.
- Product
- dr_libs dr_wav.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026A reflected Cross-Site Scripting (XSS) vulnerability in the RaiseError function of Skrol29 TbsZip version 2.17 and earlier allows remote attackers to execute arCVE-2025-65465 · Other software · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) vulnerability in the RaiseError function of Skrol29 TbsZip version 2.17 and earlier allows remote attackers to execute arbitrary web script or HTML via a crafted payload in a filename parameter (e.g., to the FileRead function). This occurs because the error message is not properly sanitized before being output to the user. This vulnerability is fixed in version 2.18.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 27, 2026NULL Pointer Dereference vulnerability in abcz316 SKRoot-linuxKernelRoot (testRoot/jni/utils modules).CVE-2026-24813 · Other software · abcz316 · reported by cve_disclosure@tech.gov.sgHigh 8.7
NULL Pointer Dereference vulnerability in abcz316 SKRoot-linuxKernelRoot (testRoot/jni/utils modules). This vulnerability is associated with program files cJSON.Cpp. This issue affects SKRoot-linuxKernelRoot.
- Product
- SKRoot-linuxKernelRoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2026dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metCVE-2025-14369 · Other software · mackron · reported by cret@cert.orgMedium 5.5
dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC metadata before calculating buffer size, allowing an attacker with a specially crafted file to perform DoS against programs using the tool.
- Product
- dr_flac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Titra is open source project time tracking software.CVE-2026-21695 · Other software · kromitgmbh · reported by GitHubMedium 4.3
Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.
- Product
- titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Titra is open source project time tracking software.CVE-2026-21694 · Other software · kromitgmbh · reported by GitHubMedium 6.8
Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50.
- Product
- titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025Titra is open source project time tracking software.CVE-2025-69288 · Other software · kromitgmbh · reported by GitHubCritical 9.1
Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.
- Product
- titra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array.CVE-2025-14896 · Other software · yuzutech · reported by report@snyk.ioHigh 8.7
due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file system paths, leading to exposure of sensitive information.
- Product
- kroki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Cross-Site Request Forgery (CSRF) vulnerability in Tekrom Technology Inc.CVE-2025-13296 · Websites & servers · Tekrom Technology Inc. · reported by iletisim@usom.gov.trMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tekrom Technology Inc. T-Soft E-Commerce allows Cross Site Request Forgery. This issue affects T-Soft E-Commerce: through 28112025.
- Product
- T-Soft E-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.