Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
232 results · page 1 of 5
Oct 27, 2026KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API.CVE-2026-105987 · Other software · KGS Software · reported by cvd@cert.plMedium 5.1
KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker can inject arbitrary JavaScript payload into a stickynote annotation. When any user opens the document, the viewer renders the annotation and the browser executes the payload. This may lead to compromising the user's session. This issue has been fixed in version 1.2.8.
- Product
- tia Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plkgs-software.com
Oct 26, 2026OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the pubCVE-2026-116810 · Other software · Openpanel-dev · reported by VulnCheckMedium 6.9
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers.
- Product
- openpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations).CVE-2026-16477 · Other software · MTW · reported by cvd@cert.plHigh 8.4
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10
- Product
- CleanShot X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing CVE-2026-112778 · Other software · traefik · reported by VulnCheckMedium 6.4
Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates, bypassing namespace-based tenant isolation.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 19, 2026Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.CVE-2026-110676 · Websites & servers · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB. Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 15, 2026In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServCVE-2026-18661 · Other software · reported by emo@eclipse.orgHigh 8.8
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgitlab.eclipse.org
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations.CVE-2026-108640 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit fields.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod.CVE-2026-97146 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.8
Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments. The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue.
- Product
- Apache YuniKorn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 7, 2026Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks.CVE-2026-92393 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 2
Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE action correctly enforces the checks for all object types. The bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue.
- Product
- Apache YuniKorn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 30, 2026An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboardCVE-2026-13720 · Other software · Grafana · reported by security@grafana.comMedium 5.4
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations.CVE-2026-91818 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations.CVE-2026-91816 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in sCVE-2026-91804 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. Insufficient validation of the appearance geometry can result in memory corruption and application crashes.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data.CVE-2026-91793 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScripCVE-2026-91792 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allCVE-2026-92126 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.5
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is present on the classpath of the component that evaluates the script.
- Product
- Jenkins Script Security Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permissioCVE-2026-92125 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox protection and executing arbitrary code in the context of the Jenkins controller JVM.
- Product
- Jenkins Script Security Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, aCVE-2026-92463 · Other software · guchengwuyue · reported by VulnCheckHigh 7.1
yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.
- Product
- yshop-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations.CVE-2026-90939 · Other software · 201206030 · reported by VulnCheckHigh 7.1
novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope, enabling offline hash cracking and account takeover.
- Product
- novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does CVE-2026-71807 · Other software · reported by MITREMedium 4.3
In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details (/task/getTask/{taskId}) and trigger unauthorized workflow executions (/task/startWorkFlow).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation.CVE-2026-55273 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation inCVE-2026-85594 · Other software · traefik · reported by VulnCheckHigh 7
Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its Service, and if that middleware injects backend credentials, recover them at a controlled backend.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 3, 2026Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRoCVE-2026-85213 · Other software · killbill · reported by VulnCheckHigh 7.2
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.
- Product
- killbill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuraCVE-2026-84658 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration.
- Product
- Jenkins Script Security Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress ControllCVE-2026-77180 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attacker granted write access to NGINX Ingress Controller Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Ingress Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a DCVE-2026-82834 · Other software · Doccano · reported by VulDBLow 2.1
A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. This affects the function LabelList of the file /v1/projects/1/category-types of the component Bulk-Delete Endpoint. Performing a manipulation results in improper access controls. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Open Source Annotation Tools for Machine Learning Practitioners
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Aug 31, 2026A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a DocumeCVE-2026-82833 · Other software · Doccano · reported by VulDBLow 2.1
A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component Project Example Detail Endpoint. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Open Source Annotation Tools for Machine Learning Practitioners
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Aug 24, 2026Label Studio does not scope the annotation detail endpoint to the requesting user's organization.CVE-2026-76073 · Other software · HumanSignal · reported by VulnCheckHigh 8.7
Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and label_studio/core/permissions.py registers every permission with rules.is_authenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with project__organization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file.
- Product
- label-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.CVE-2026-66797 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-73220 · Other software · cvat-ai · reported by GitHubHigh 8.5
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to MDEditor without the rehype-sanitize plugin. A user who can create or edit an annotation guide can store malicious JavaScript that executes when another user opens the guide. The script can issue arbitrary CVAT requests with the victim user's privileges. This issue is fixed in version 2.70.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.CVE-2026-16440 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.7
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.
- Product
- Eclipse OpenJ9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint.CVE-2026-73041 · Other software · siyuan-note · reported by VulnCheckCritical 9.4
SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 15, 2026In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missingCVE-2026-72120 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of list_add_rcu() in bcm_[rx|tx]_setup() to have a proper initialized bcm_op structure when bcm_proc_show() traverses the bcm_op's under rcu_read_lock(). To cover all initial settings of the bcm_op's the list_add_rcu() calls are moved to the end of the setup code. While at it, also fix the mirroring removal side: bcm_release() called bcm_remove_op() - which frees the op via call_rcu() - on ops that were still linked in bo->tx_ops/bo->rx_ops, without list_del_rcu() first. Unlink each op with list_del_rcu() before handing it to bcm_remove_op(), matching the existing pattern in bcm_delete_tx_op()/bcm_delete_rx_op().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 14, 2026SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing CVE-2026-73048 · Other software · siyuan-note · reported by VulnCheckMedium 6.9
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotation identifiers visible in published pages, revealing citation relationships across forbidden and password-protected tiers.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 13, 2026The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recordedCVE-2026-72640 · Other software · Elastic · reported by security@elastic.coMedium 6.5
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissions are limited to their own namespace can write that annotation, trigger a reconcile, and cause the operator to use its cluster-wide secret permissions to copy the contents of a secret from any other namespace into a secret the user can read.
- Product
- Eck Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, whichCVE-2026-72808 · Other software · siyuan-note · reported by VulnCheckMedium 6.9
SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth (unlike the /assets/* route, which enforces publish access and password), an anonymous reader (when publish authentication is disabled) or any publish RoleReader who knows an asset path can read the private PDF annotations (highlights and notes) of publish-forbidden, password-protected, or unpublished documents. The issue is limited to non-encrypted notebooks; encrypted-box annotations are not exposed.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 11, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-73221 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-73219 · Other software · cvat-ai · reported by GitHubMedium 5.3
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines the single active request slot, block automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaChCVE-2026-70559 · Other software · DataLinkDC · reported by VulnCheckHigh 8.7
Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port (8888 by default) receives the full live system configuration (54 entries on a stock v1.2.5 install) with one parameterless GET. Only one credential field (sys.maven.settings.repositoryPassword) has a desensitization handler wired; the other credential-bearing fields (sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token) return in cleartext. A bare install leaks the shipped defaults, including the hardcoded dinkyToken efda1551-7958-4e0f-80a8-dfd107df3e38 and minioadmin/minioadmin OSS keys; once an operator configures LDAP, object storage, or DolphinScheduler through the Settings Center, those live third-party credentials leak from the same endpoint. Because dinkyToken is the sole gate on the sibling POST /download/uploadFromRsByLocal arbitrary file write, this disclosu
- Product
- Dinky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmenCVE-2026-18275 · Other software · Scripta · reported by cve@gitlab.comMedium 6.5
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect
- Product
- eScriptorium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-65986 · Other software · cvat-ai · reported by GitHubHigh 8.5
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type ( Content-Type ) that the attacker can influence, so instead of treating an uploaded file as plain data, the victim's browser can be told to treat it as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026CVAT is an open source interactive video and image annotation tool for computer vision.CVE-2026-47682 · Other software · cvat-ai · reported by GitHubHigh 7.1
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations.CVE-2026-63759 · Other software · surrealdb · reported by VulnCheckHigh 7.1
SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process.
- Product
- surrealdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 15, 2026When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuratiCVE-2026-55723 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may craft values that inject arbitrary NGINX configuration directives. Impact: An authenticated attacker granted write access to NGINX Ingress Controller CRDs or Ingress annotations through the Kubernetes API may be able to inject arbitrary NGINX configuration directives, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Ingress Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026There is an abnormal annotation within the PDF that is referenced by other objects.CVE-2026-57254 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the application to crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel tCVE-2026-57252 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will cause the attachment panel to continue accessing invalid pointers, eventually leading to the application crashing.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional action.CVE-2026-57249 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
After the application opened the PDF file, the script first reset the annotation status, then triggered the reset form event by additional action. During the re-entry process, the application access invalid objects and crashed.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks.CVE-2026-57248 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF file and JavaScript writes annotation attributes, there is a lack of sufficient object type and argument checks. As a result, due to the damage to the internal structure of the annotations, it causes the application to crash during subsequent release.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationshipsCVE-2026-57245 · Other software · Foxit Software Inc. · reported by 14984358-7092-470d-8f34-ade47a7658a2High 7.8
When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an invalid pointer write occurred, causing the application to crash.
- Product
- Foxit PDF Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2026Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during aCVE-2026-13749 · Other software · Snowflake · reported by 412d305a-227d-44f9-a262-a31ba44f2aeaHigh 8.8
Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted project content that is interpolated into generated Python code, causing Snowflake CLI to execute attacker-controlled code in the local context of the user running the CLI. Successful exploitation requires the victim to run the relevant bundling or deployment workflow against attacker-controlled project content, and any resulting code runs with the privileges of that local execution context. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.
- Product
- Snowflake CLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowflake.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.