Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,269 results · page 1 of 26
Oct 27, 2026mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results bCVE-2026-118377 · Other software · mewebstudio · reported by VulnCheckHigh 8.7
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
- Product
- pos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflecteCVE-2026-4316 · Other software · Zuinq Studio · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser.
- Product
- IsMyGym
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295.CVE-2026-116099 · Other software · Fusion Creators Studio · reported by VulDBLow 2.1
A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.
- Product
- SCP Containment Breach Multiplayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6.CVE-2026-114379 · Other software · EKKOLearnAI · reported by VulDBMedium 5.3
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue.
- Product
- ekko-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1.CVE-2026-114377 · Other software · leomoon-studios · reported by VulDBLow 2
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component.
- Product
- wiki-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A weakness has been identified in leomoon-studios wiki-go up to 1.9.1.CVE-2026-114376 · Other software · leomoon-studios · reported by VulDBLow 2.1
A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.9.2 addresses this issue. This patch is called 94f7e73ef8df7c58091d72d77a5e26e9fdad98b8. Upgrading the affected component is advised.
- Product
- wiki-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1.CVE-2026-114375 · Other software · leomoon-studios · reported by VulDBLow 2.1
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
- Product
- wiki-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1.CVE-2026-114374 · Other software · leomoon-studios · reported by VulDBLow 2.1
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
- Product
- wiki-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuildCVE-2026-113596 · Other software · webstudio-is · reported by VulnCheckLow 2.3
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.
- Product
- webstudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workCVE-2026-77935 · Other software · coze-dev · reported by VulnCheckHigh 8.7
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
- Product
- coze-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlasso.security
Oct 19, 2026Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsCVE-2026-77934 · Other software · coze-dev · reported by VulnCheckHigh 8.7
Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with __import__('subprocess') to run commands, stealing environment variables, model API keys, and accessing MySQL, MinIO, Redis and etcd.
- Product
- coze-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide loginCVE-2026-111679 · Other software · EKKOLearnAI · reported by VulnCheckMedium 5.3
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.
- Product
- ekko-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy otCVE-2026-111672 · Other software · data-infra · reported by VulnCheckMedium 5.3
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines.
- Product
- cube-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy otheCVE-2026-111671 · Other software · data-infra · reported by VulnCheckHigh 7.1
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline.
- Product
- cube-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-109468 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026PlanetStudio Payment Gateway: Missing AuthorizationCVE-2026-110362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlanetStudio Payment Gateway: from n/a through 1.3.3.
- Product
- PlanetStudio Payment Gateway
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update PlanetStudio Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54703 · Other software · shd101wyy · reported by GitHubMedium 5.8
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges, including user configuration, startup, source, and build files. This file-write vulnerability requires a separate webview JavaScript execution path, such as the independently tracked head.html injection and blind command-dispatch weaknesses. This issue is fixed in version 0.8.30.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54702 · Other software · shd101wyy · reported by GitHubHigh 7.3
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes vscode.commands.executeCommand without an allowlist or type validation. JavaScript already executing in the preview webview can use this bridge to invoke privileged extension commands, including file modification, code-chunk execution, export-tool execution, and arbitrary URL opening, with attacker-selected arguments. Exploitation requires a separate webview JavaScript execution path, such as the independently tracked .crossnote/head.html injection, but no further authorization check protects the extension-host command boundary. This issue is fixed in version 0.8.30.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54701 · Other software · shd101wyy · reported by GitHubMedium 6.9
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi to send messages from the webview to the extension host. Opening a Markdown preview in a malicious repository is sufficient to trigger the injected content, and no additional click within the notification or preview is required. This issue is fixed in version 0.8.30.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54566 · Other software · shd101wyy · reported by GitHubHigh 8.5
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing operating-system commands to execute as the victim account without further interaction. Both configuration evaluation and parser-hook evaluation are affected, and the attack does not depend on module-scoped require being available. This issue is fixed in version 0.8.29.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code.CVE-2026-54525 · Other software · shd101wyy · reported by GitHubHigh 8.8
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes child_process.exec with the start command. When a Windows user opens an untrusted Markdown file and clicks a crafted external or unsupported-scheme link, shell metacharacters in the decoded target are interpreted by cmd.exe as command separators, allowing an attacker-selected command to run with the privileges of the current VS Code user. The attack requires one normal preview-link click but does not require malicious workspace configuration, script execution to be enabled, or additional files. This issue is fixed in version 0.8.28.
- Product
- vscode-markdown-preview-enhanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-70098 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a netwCVE-2026-102238 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-102235 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-102234 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a netwCVE-2026-96230 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.CVE-2026-85790 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-70179 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests.CVE-2026-70162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-70159 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over aCVE-2026-69370 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attackCVE-2026-103572 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2026-102869 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.CVE-2026-102851 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-102233 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-102232 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-102231 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.7
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over CVE-2026-102229 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform.CVE-2026-49484 · Other software · codefori · reported by GitHubMedium 5.1
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.
- Product
- vscode-ibmi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform.CVE-2026-49483 · Other software · codefori · reported by GitHubHigh 8.9
Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.
- Product
- vscode-ibmi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently valiCVE-2026-85953 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8.5
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.
- Product
- MarkLogic Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 11, 2026A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1.CVE-2026-108523 · Other software · Studio-Saelix · reported by VulDBLow 2.1
A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing,
- Product
- Sencho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 11, 2026A vulnerability was found in Studio-Saelix Sencho up to 0.94.1.CVE-2026-108522 · Other software · Studio-Saelix · reported by VulDBMedium 5.5
A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: "The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity."
- Product
- Sencho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 10, 2026A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1.CVE-2026-108521 · Other software · Studio-Saelix · reported by VulDBLow 2
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."
- Product
- Sencho
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 2, 2026OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, CVE-2026-104019 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9.3
OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might allow an authenticated remote user with project contributor permissions to execute arbitrary commands in another project member's Studio Space and obtain that member's temporary execution role credentials via a crafted connection resource property that is interpolated into a shell invocation without neutralization. To remediate this issue, users should upgrade to version 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, or 4.4.3, as applicable to the minor line in use. Users on minor lines that have reached end of support must move to a supported minor line, because no patched version will be released for those lines. In Amazon SageMaker Unified Studio, Studio Spaces adopt the latest patch of their minor line on restart once the patched images are deployed, so no version selection is required.
- Product
- sagemaker-distribution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Oct 1, 2026LA-Studio Element Kit for Elementor: Server-Side Request Forgery (SSRF)CVE-2026-103082 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 29, 2026OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who coCVE-2026-102437 · Other software · esengine · reported by cve@gitlab.comHigh 7.8
OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.
- Product
- DeepSeek-Reasonix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2.CVE-2026-93559 · Other software · Forget-C · reported by VulDBMedium 6.9
A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The reported GitHub issue was closed automatically due to inactivity.
- Product
- Jellyfish AI Short Drama Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026Easy Form Builder by WhiteStudio: Does not validate a submitted value against the stored configuration for some of its form typesCVE-2026-85123 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration.
- Product
- Easy Form Builder by WhiteStudio
- Fixed in
- 4.2.0
- What to do
- Update Easy Form Builder by WhiteStudio to 4.2.0 or newer.
Sep 18, 2026Easy Form Builder by WhiteStudio: Does not validate a submitted value against the stored configuration for some of its form typesCVE-2026-85122 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.
- Product
- Easy Form Builder by WhiteStudio
- Fixed in
- 4.2.0
- What to do
- Update Easy Form Builder by WhiteStudio to 4.2.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.