Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,803 results · page 1 of 37
Oct 28, 2026Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.CVE-2026-115522 · Computers, phones & browsers · Google · reported by cve-coordination@google.comMedium 5.3
Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping.
- Product
- Agent Development Kit (ADK) for Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon.CVE-2026-108089 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Apache Cocoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 14, 2026Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilityCVE-2026-101217 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Unisphere for PowerMax vApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerabCVE-2026-101216 · Other software · Dell · reported by security_alert@emc.comMedium 6.6
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- Unisphere for PowerMax vApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vCVE-2026-101215 · Other software · Dell · reported by security_alert@emc.comMedium 6.6
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- Unisphere for PowerMax vApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.CVE-2026-95696 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorizatCVE-2026-95695 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enableCVE-2026-93909 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch joCVE-2026-93905 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRCVE-2026-93895 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system.CVE-2026-79715 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks.CVE-2026-77816 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attackeCVE-2026-14909 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exCVE-2026-14532 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabCVE-2026-11713 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.CVE-2026-105443 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker toCVE-2026-105442 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass CVE-2026-101294 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.7
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information oveCVE-2026-97740 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally.CVE-2026-96935 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information lCVE-2026-96865 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.6
Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.CVE-2026-96237 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.CVE-2026-87695 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Exchange Server 2016 Cumulative Update 23
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.CVE-2026-85866 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information locaCVE-2026-85793 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.CVE-2026-85355 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informatiCVE-2026-83909 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.CVE-2026-83907 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.CVE-2026-83905 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informatiCVE-2026-83897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker to disclose informatiCVE-2026-83893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informatiCVE-2026-83774 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information CVE-2026-83773 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.CVE-2026-83705 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.CVE-2026-83672 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-70267 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.2
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information CVE-2026-70261 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information CVE-2026-70260 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-70232 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-70199 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose informatiCVE-2026-70055 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally.CVE-2026-69644 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-108462 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cCVE-2026-95680 · Other software · IBM · reported by psirt@us.ibm.comHigh 8
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handlCVE-2026-93907 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticCVE-2026-103499 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
- Product
- WebSphere Application Server - Liberty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts.CVE-2026-109189 · Other software · fit2cloud · reported by VulDBLow 2.1
A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. The affected element is the function Swagger3ParserApiDefinition.testUrlTimeout of the file backend/parser/api/dataimport/Swagger3ParserApiDefinition.java of the component Swagger3 Parser. Performing a manipulation of the argument swaggerUrl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MeterSphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026YITH WooCommerce Product Add-Ons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-66480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.
- Product
- YITH WooCommerce Product Add-Ons
- Affected
- up to 4.34.0
- What to do
- Affects up to 4.34.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026All Bootstrap Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-62036 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31.
- Product
- All Bootstrap Blocks
- Affected
- up to 1.3.31
- What to do
- Affects up to 1.3.31. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere vulnerabiliCVE-2026-78019 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Filesystem access for attacker, and Remote execution.
- Product
- Secure Connect Gateway (SCG) Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.