Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23,194 results · page 1 of 464
Oct 28, 2026A security vulnerability has been detected in nipy nibabel up to 5.4.2.CVE-2026-118590 · Other software · nipy · reported by VulDBMedium 6.9
A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
- Product
- nibabel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026A security flaw has been discovered in dfm feedfinder2 up to 0.0.4.CVE-2026-118586 · Other software · dfm · reported by VulDBMedium 6.9
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- feedfinder2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8.CVE-2026-118578 · Other software · maotoumao · reported by VulDBLow 2.1
A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MusicFreeDesktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026decode-uri-component provides a more robust alternative to decodeURIComponent.CVE-2026-118664 · Other software · SamVerschueren · reported by GitHubHigh 8.2
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.
- Product
- decode-uri-component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat DefensCVE-2026-76418 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to logic errors when secondary authentication is configured on a tunnel group. An attacker could exploit this vulnerability by sending a crafted request when connecting to the SSL remote access VPN. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
- Product
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 28, 2026EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API erCVE-2026-118686 · Other software · espocrm · reported by VulnCheckHigh 8.7
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 28, 2026when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthentiCVE-2026-84725 · Other software · Red Hat · reported by Red HatHigh 8.1
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
- Product
- Red Hat JBoss Enterprise Application Platform 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 28, 2026PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view.CVE-2026-105619 · Other software · DALIBO · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 4.8
PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
- Product
- PostgreSQL Anonymizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStreamCVE-2026-117612 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.com
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes.CVE-2026-59185 · Other software · identrail · reported by GitHubHigh 8.5
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller's workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller's tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller's connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application's JWT. An authenticated tenant who starts a legitimate connection can supply another customer's non-secret installation ID to read the victim organization's private repository inventory, content, and metadata or drive posture scans, provided identrail's GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path share
- Product
- identrail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026WP Discussion Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115957 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Stored XSS.This issue affects WP Discussion Board: from n/a through 2.6.0.
- Product
- WP Discussion Board
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update WP Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026SliceWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115612 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13.
- Product
- SliceWP
- Affected
- up to 1.2.13
- What to do
- Affects up to 1.2.13. Update SliceWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026GetPaid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.
- Product
- GetPaid
- Affected
- up to 2.8.62
- What to do
- Affects up to 2.8.62. Update GetPaid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026DXP ToolKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115606 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS.This issue affects DXP ToolKit: from n/a through 2.0.1.
- Product
- DXP ToolKit
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update DXP ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115596 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-115593 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.24.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.24
- What to do
- Affects up to 2.0.24. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeup_preempt() for queued tasks during class change Paul reported recenCVE-2026-99205 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeup_preempt() for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at the time of idling with runnable tasks showed the following: rq->next_class = &fair_sched_class rq->nr_running = 1 rq->cfs.h_nr_queued = 0 rq->rt.rt_nr_running = 1 Although the waiting task was an RT task, "rq->next_class" did not point to rt_sched_class and was stuck at the lower priority fair_sched_class. Inspecting sched_change_end() revealed the following race with __sched_setscheduler() for queued, but non-running tasks: CPU0 CPU1 ==== ==== __schedule() /* * rq->donor is a fair task that blocks. * rq->next_class = &fair_sched_class */ rq_lock(rq0) pick_next_task() /* nr_running = 0 */ pick_task_fair() sched_balance_newidle() raw_spin_rq_unlock(rq0) rq_lock(rq0)
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records musCVE-2026-99204 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debug_state_print() walks reco.node_data and formats their fields. The formatter holds dlm->spinlock, but the recovery participant list is protected by dlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches the list under dlm_reco_state_lock and frees the detached records after releasing it. A concurrent debugfs open can therefore read freed memory. Protect the participant traversal and field reads in debug_state_print() with dlm_reco_state_lock, matching the existing list writers. This also serializes the traversal against list_add_tail() during recovery-area initialization. Make the existing lock available to the debug code through dlmcommon.h; the lock remains internal to the OCFS2 DLM module. Release dlm->spinlock after formatting the other domain state and before acquiring dlm_reco_state_lock, so the debug reader does not nest the two locks. Leave recovery list insertion, detachment and freeing unchanged. KASAN report as below: BUG: KASAN: slab-use-after-free in debug_state
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smp_execute_task_sg() calls pm_runtime_CVE-2026-99202 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smp_execute_task_sg() calls pm_runtime_get_sync() on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the get_sync() deadlocks: it waits for the ongoing resume (the device is RPM_RESUMING), while the resume is blocked in sas_drain_work() waiting for that same SMP IO to complete. The deadlock needs an expander-attached SATA disk. During sas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata() -> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for such a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() -> sas_phy_reset() -> sas_smp_phy_control() -> smp_execute_task_sg()). Direct-attached SATA resets through lldd_control_phy() and SSP devices use TMFs, so neither hits this. Replace the get_sync()/put_sync() pair with pm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only needs to hold off autosuspend while the SMP is in flight, and it must not try to resume the host: a sync resume issued from the HA resume path itself is what deadlocks, and by the time sas_resume
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotify_destroy_marks() keeps CVE-2026-99175 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotify_destroy_marks() keeps a reference to its current mark while it drops conn->lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a new mark from being inserted before it. For example, an inotify watch re-added after IN_IGNORED sorts before the old, detached mark for the same group. The walk can miss the replacement and then detach the entire connector from the object. The replacement is still on its group's marks_list and, for inotify, in the watch IDR. The group mutex no longer protects the connector's object from disappearing. An unprivileged fdinfo read racing the final detach can consequently call igrab(NULL): BUG: KASAN: null-ptr-deref in igrab+0x24/0x100 Write of size 4 at addr 0000000000000148 Call Trace: igrab+0x24/0x100 inotify_show_fdinfo+0x1dc/0x5e0 seq_show+0x397/0x690 Set a DESTROYING flag under conn->lock before starting the walk, and reject new marks on that connector with -ENOENT. The existing add-mark error paths undo the temporary group-list entry and the backend's watch alloca
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: don't spin on local work the task can't run io_uring_cancel_generic() refCVE-2026-99130 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: don't spin on local work the task can't run io_uring_cancel_generic() refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the next io_uring_try_cancel_requests() pass will run the work. This does not hold for a ring that was still IORING_SETUP_R_DISABLED when the task got its tctx node from io_uring_create() or io_ringfd_register(). The submitter is set later by IORING_REGISTER_ENABLE_RINGS, possibly from another task, and only the submitter may run local work on an IORING_SETUP_DEFER_TASKRUN ring. To the exiting task the work stays pending forever, the loop never reaches schedule(), and the task trips the WARN_ON_ONCE() once and then spins in do_exit(). An unprivileged user can set this up at will by creating a disabled ring, having a child enable it and stop, posting to the ring with IORING_OP_MSG_RING and exiting with a request in flight that only the child can complete. The exiting thread burns a CPU until the child runs or dies, and with panic_on_warn set the WARN panics the kernel. Fix by skipping the sle
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 28, 2026Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows aCVE-2026-6064 · Other software · Gen Digital · reported by security@nortonlifelock.comHigh 7.3
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.
- Product
- Norton Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for alCVE-2026-101272 · Other software · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.3
The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some other related code areas.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fazile BACAK DefterAsist Financial Advisor Platform allowsCVE-2026-16020 · Other software · Fazile BACAK · reported by iletisim@usom.gov.trMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fazile BACAK DefterAsist Financial Advisor Platform allows Stored XSS. This issue affects DefterAsist Financial Advisor Platform: through 2026-10-27.
- Product
- DefterAsist Financial Advisor Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6.CVE-2026-118271 · Other software · a2ui-project · reported by VulDBLow 2.1
A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is eb314e14fabd29cfb4a74e1202afc4fe2081efa2. Applying a patch is advised to resolve this issue.
- Product
- a2ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointCVE-2026-118177 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags.CVE-2026-118173 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 6.1
MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only verified that at least one tag of that taxonomy matched the configured allowed list. It did not verify that every tag of the required taxonomy present on the event or attribute was in the allowed list. As a result, an event or attribute could simultaneously carry an allowed tag (e.g., tlp:clear) and a non-allowed tag (e.g., tlp:red or tlp:amber) and still pass the guard's policy check. This allowed data marked with a higher classification or sensitivity level to be distributed through feeds configured to only distribute lower-classification data, effectively bypassing the intended data-handling restrictions. The vulnerability affected both event-level and attribute-level tag validation, including attributes nested within objects and shadow attributes. An attacker with the ability to author or modify MISP events in a feed source could include non-allowed taxonomy tags alongside allowed ones to exfiltrate more sensitive data to fee
- Product
- misp-guard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635.CVE-2026-117515 · Other software · oretnom23 · reported by VulDBMedium 5.5
A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- php-travel-agency-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in anCVE-2026-114596 · Other software · The EPICS Community · reported by ics-cert@hq.dhs.govHigh 8.8
In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
- Product
- EPICS Base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, CVE-2025-64394 · Other software · Veeam · reported by support@hackerone.comMedium 4.3
A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
- Product
- Backup for Microsoft 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of AdvCVE-2026-111583 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7.3
Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final.CVE-2026-117507 · Other software · a2aproject · reported by VulDBMedium 5.3
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.
- Product
- a2a-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final.CVE-2026-117505 · Other software · a2aproject · reported by VulDBMedium 5.3
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficient to resolve this issue. The patch is named be663f806efcfdddd2805d214fae4998379ac5f2. It is advisable to upgrade the affected component.
- Product
- a2a-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Mitigation bypass in the DOM: Security component.CVE-2026-117967 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Incorrect boundary conditions in the Security: PSM component.CVE-2026-117893 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 27, 2026Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc.CVE-2026-92546 · Other software · Keepnet Labs Cybersecurity Inc. · reported by iletisim@usom.gov.trHigh 7.5
Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e.
- Product
- Agentic AI / Agentic Ally
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 aCVE-2026-116627 · Other software · Devolutions · reported by security@devolutions.net
Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.
- Product
- PowerShell Universal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co.CVE-2026-100164 · Other software · Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. · reported by iletisim@usom.gov.trHigh 7.5
Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8.
- Product
- Agentis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay aCVE-2026-41020 · Other software · Eaton · reported by CybersecurityCOE@eaton.comHigh 7.5
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
- Product
- easyE4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company KulgCVE-2026-105323 · Other software · Kulga Software and Telecommunications Limited Company · reported by iletisim@usom.gov.trMedium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and Telecommunications Limited Company Kulga News Software allows Reflected XSS. This issue affects Kulga News Software: from v26.7.4 before v26.10.0.
- Product
- Kulga News Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client withouCVE-2026-117471 · Other software · esaqa GmbH · reported by fdf66990-8419-4c8c-8848-ec15d75773b4Medium 5.4
Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.
- Product
- Psono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0.CVE-2026-116620 · Other software · Tencent · reported by VulDBMedium 5.5
A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- RapidJSON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1.CVE-2026-116608 · Other software · DAMO Academy · reported by VulDBLow 2.1
A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- VideoLLaMA2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RECVE-2026-116804 · Other software · cure53 · reported by VulnCheckMedium 5.1
DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent CVE-2026-116803 · Other software · cure53 · reported by VulnCheckMedium 5.1
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize() returns, causing DOM XSS.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE iCVE-2026-116802 · Other software · cure53 · reported by VulnCheckMedium 5.1
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set element using attributeName="href" and a javascript: entry in values to execute script when users click the sanitized link.
- Product
- DOMPurify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 26, 2026A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104.CVE-2026-116508 · Other software · TOTOLINK · reported by VulDBCritical 9.3
A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
- Product
- A950RG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 26, 2026A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2.CVE-2026-116477 · Other software · a2aproject · reported by VulDBMedium 5.3
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
- Product
- a2a-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0.CVE-2014-125135 · Other software · reported by VulDBMedium 6.9
A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFCVE-2026-116638 · Other software · reported by MITRE
The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.