Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
788 results · page 1 of 16
Oct 26, 2026Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector'sCVE-2026-116489 · Other software · timescale · reported by VulnCheckHigh 7.7
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.
- Product
- pgvectorscale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to exCVE-2026-76740 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.2
A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.
- Product
- HPE Compute Scale-up Server 3200 platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modiCVE-2026-76739 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.3
A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem.
- Product
- HPE Compute Scale-up Server 3200 platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More: Arbitrary File UploadCVE-2026-111311 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.
- Product
- DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG bCVE-2026-110839 · Other software · FreeRDP · reported by VulnCheckHigh 7.1
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerCVE-2026-94348 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- PowerScale InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability.CVE-2026-35161 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- PowerScale InsightIQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026HyperScale contained a path traversal issue affecting information disclosure.CVE-2026-18228 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333High 7.1
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
- Product
- Commvault Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Oct 12, 2026A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98.CVE-2026-108942 · Other software · philz1337x · reported by VulDBMedium 5.1
A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file modules/ui_extra_networks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description results in cross site scripting. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. All versions in the repository are affected, as the codebase is based on AUTOMATIC1111/stable-diffusion-webui v1.7.0 code. Upstream AUTOMATIC1111/stable-diffusion-webui (v1.8.0, released March 1, 2024) contains the fix. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- clarity-upscaler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.CVE-2026-107406 · Other software · NetScaler · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5Critical 9.5
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive For the following versions: Applicable only when configured as a SAML SP or SAML IdP: * NetScaler ADC and NetScaler Gateway before 14.1-73.37 * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS * NetScaler ADC and NetScaler Gateway before 13.1-64.23 * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279
- Product
- ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comcommunity.citrix.com
Oct 6, 2026A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (applicationCVE-2026-19029 · Other software · The HDF Group · reported by 0253b833-3e77-4dfe-9d57-17db1a2f0a74Medium 6.8
A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service (application crash) with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d_nelmts * size bytes from the compressed chunk without checking that the chunk holds that many bytes. Both values come from attacker-controlled scale-offset filter parameters in the dataset's filter pipeline message.
- Product
- HDF5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware UpgrCVE-2026-0461 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.
- Product
- Zynq™ UltraScale+ MPSoCs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88779 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedHigh 8.7
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
- Product
- NetScaler
- On CISA’s list since
- Oct 4, 2026 (federal fix deadline Oct 7, 2026)
- What to do
- Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.citrix.comcommunity.citrix.com
Sep 28, 2026Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP clientCVE-2026-59563 · Other software · Zscaler · reported by cve@zscaler.comMedium 4.6
Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.
- Product
- zscaler-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.CVE-2026-88778 · Network & remote access · Citrix NetScaler · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5High 8.8
Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23.
- Product
- ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.CVE-2026-88777 · Network & remote access · Citrix NetScaler · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5High 8.8
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service
- Product
- ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.CVE-2026-88776 · Network & remote access · Citrix NetScaler · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5High 8.8
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service
- Product
- ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.CVE-2026-88775 · Network & remote access · Citrix NetScaler · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5High 8.8
Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
- Product
- ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.CVE-2026-88774 · Network & remote access · Citrix NetScaler · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5High 7
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.
- Product
- ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.CVE-2026-88773 · Network & remote access · Citrix NetScaler · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5Critical 9.3
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
- Product
- ADC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2026Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCVE-2026-88772 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
- Product
- NetScaler
- On CISA’s list since
- Sep 27, 2026 (federal fix deadline Sep 30, 2026)
- What to do
- Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.citrix.comcisa.gov
Sep 27, 2026Citrix NetScaler Improper Input Validation VulnerabilityCVE-2026-88771 · Network & remote access · Citrix · reported by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5ExploitedCritical 9.5
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
- Product
- NetScaler
- On CISA’s list since
- Sep 27, 2026 (federal fix deadline Sep 30, 2026)
- What to do
- Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.citrix.comcisa.gov
Sep 21, 2026deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale.CVE-2026-63116 · Other software · deepstreamIO · reported by GitHubHigh 8.8
deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.
- Product
- deepstream.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-88978 · Other software · hatchet-dev · reported by GitHubMedium 4.3
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-84298 · Other software · hatchet-dev · reported by GitHubLow 3.1
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload. UUIDv4 values are not enumerable, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.95.3.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-63342 · Other software · hatchet-dev · reported by GitHubMedium 6.3
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-61687 · Other software · hatchet-dev · reported by GitHubHigh 7.1
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-61681 · Other software · hatchet-dev · reported by GitHubMedium 4.1
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-85272 · Other software · openedx · reported by GitHubMedium 4.3
Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extract_archive.py uses _is_bad_path to validate safe_extractall targets by comparing resolved path strings with startswith instead of comparing path components. A course author or staff user with course import permission can submit a crafted .tar.gz archive through the import_olx flow initiated by cms.djangoapps.contentstore.views.import_export.import_handler. An archive member can therefore escape into a sibling course staging directory whose name shares the attacker's base64 directory prefix, causing limited cross-tenant file corruption. Zip archives are not practically affected because ZipFile.extractall strips parent traversal segments, and the advisory does not establish arbitrary filesystem writes, file reads, or direct code execution. This issue is fixed in Ulmo and Verawood.1.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-85271 · Other software · openedx · reported by GitHubMedium 6.1
Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get_notification_content in openedx/core/djangoapps/notifications/base_notification.py. An enrolled student can place CSS-capable markup in the post_title value supplied by lms/djangoapps/discussion/rest_api/discussions_notifications.py. Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digest_content.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare CVE-2026-25684 · Other software · Zscaler · reported by cve@zscaler.comMedium 4.4
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances.
- Product
- ZIA File Type Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS.CVE-2026-76104 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- ObjectScale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability.CVE-2026-70416 · Other software · Dell · reported by security_alert@emc.comCritical 10
Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- ObjectScale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnerability.CVE-2026-26947 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- ECS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability.CVE-2025-43936 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- ObjectScale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographic Algorithm vulnerabCVE-2025-36591 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographic Algorithm vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- Elastic Cloud Storage (ECS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackersCVE-2026-82028 · Other software · absmach · reported by VulnCheckHigh 8.7
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without parameterization or identifier quoting. Attackers with a self-registered account can substitute arbitrary subqueries to achieve cross-tenant database reads, extract pg_shadow password hashes, read and write arbitrary files, and execute arbitrary code as the postgres OS user by loading attacker-supplied shared objects, with all injected SQL executing at superuser privilege due to the default PostgreSQL role configuration.
- Product
- magistrala
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.CVE-2026-59570 · Other software · Zscaler · reported by cve@zscaler.comHigh 7.5
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.CVE-2026-59569 · Other software · Zscaler · reported by cve@zscaler.comHigh 8.1
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (clCVE-2026-25687 · Other software · Zscaler · reported by cve@zscaler.comHigh 8.1
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages.CVE-2026-48496 · Other software · open-telemetry · reported by GitHubMedium 6.2
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.
- Product
- opentelemetry-ebpf-profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection CVE-2026-70425 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to root, impacting confidentiality, integrity, and availability.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization CVE-2026-46460 · Other software · Dell · reported by security_alert@emc.comLow 3.5
Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized modification of system logs.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability.CVE-2026-40635 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough CVE-2026-80740 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough that scaled_font exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in drm_log_draw_kmsg_record() because the loop never decrements len. Check for zero rows/columns in drm_log_setup_modeset() and return an error, cleaning up the already allocated buffer to avoid a leak.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 2, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-55421 · Other software · openedx · reported by GitHubMedium 6.8
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-53636 · Other software · openedx · reported by GitHubMedium 4.7
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Open edX Platform enables the authoring and delivery of online learning at any scale.CVE-2026-53635 · Other software · openedx · reported by GitHubHigh 7.6
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single POST request to overwrite the honor mode price and currency of any course on the platform. The companion frontend modal was removed in a prior cleanup, but the URL route and view remain live, making this an unguarded orphan endpoint. This issue has been patched via commit 59bb6d6.
- Product
- openedx-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulneraCVE-2026-22056 · Other software · NetApp · reported by security-alert@netapp.comLow 2.3
StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service.
- Product
- StorageGRID
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.CVE-2026-54746 · Other software · hatchet-dev · reported by GitHubMedium 6.4
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe. An authenticated owner of any tenant who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker from the dispatcher. This can cause cross-tenant integrity impact and denial of service on multi-tenant Hatchet Cloud or shared self-hosted deployments. Single-tenant deployments are not practically affected because the attacker and target tenant are the same. This issue is fixed in version 0.91.1.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.