Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,661
- Published in 7 days
- 203
- Critical in 30 days
- 35
- Actively exploited
- 47
Latest vulnerabilities
9,661 vulnerabilities- High 7.5
CVE-2026-48937 · Node.js
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
Published 18 Jun 2026 · Fixed in 22.23.0, 24.17.0 · NVD - High 8.7
CVE-2026-55204 · HAProxy
HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial…
Published 18 Jun 2026 · Fixed in 3.0.24, 3.2.20, 3.4.1 · NVD - Critical 9.0
CVE-2026-55203 · HAProxy
HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser,…
Published 18 Jun 2026 · Fixed in 3.0.24, 3.2.20, 3.4.1 · NVD - High 8.2
CVE-2026-48617 · Node.js
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Published 18 Jun 2026 · NVD - Medium 6.3
CVE-2026-48142 · nginx
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the…
Published 17 Jun 2026 · NVD - Critical 9.2
CVE-2026-42530 · nginx
NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally,…
Published 17 Jun 2026 · Fixed in 1.31.2 · NVD - Critical 9.2
CVE-2026-42055 · nginx
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated…
Published 17 Jun 2026 · NVD - High 7.5
CVE-2026-46863 · MySQL
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL…
Published 17 Jun 2026 · NVD - Medium 5.3
CVE-2026-47264 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializer#tag_group_names returned every tag group a tag belonged to without filtering against the requesting user's visibility. With SiteSetting.tags_listed_by_group enabled, anonymous and unprivileged users…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - Medium 4.3
CVE-2026-47263 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/<id> in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the channel readable by any authenticated user (or anonymous user on instances where login_required is…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - Medium 6.8
CVE-2026-45775 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a path traversal vulnerability in Discourse backup handling could allow an authenticated administrator on one site in a multisite deployment to access backup files belonging to another site when backups are stored locally.…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - Medium 5.3
CVE-2026-45085 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, four authorization/disclosure issues in the chat plugin (one also involving discourse-calendar): read-only category users could create chat threads, self-deleted chat messages could be restored by their author after channel…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - High 7.5
CVE-2026-44786 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public category channels are published to MessageBus without permission scoping, so any MessageBus subscriber without chat enabled could receive chat message payloads in real time. This issue has been…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - Medium 4.3
CVE-2026-44785 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks can_see? on the post being explained, not its reply_to_post, so any authenticated user with access to the AI helper could read the raw contents of a hidden parent post by invoking…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - Medium 6.5
CVE-2026-44784 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, group owners who are not necessarily admins or moderators can view a group's outgoing email/SMTP credentials in plaintext via the group history log (/groups/:name/logs.json). Affected fields: email_password, email_username,…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - Medium 5.4
CVE-2026-44783 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a flaw in how replies to whisper posts are handled allows authenticated users outside the groups configured in whispers_allowed_groups to post into a topic's staff-only whisper channel. The injected content is visible to…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - Medium 4.3
CVE-2026-44782 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, GroupPostSerializer declared include_user_long_name? as the predicate for its :name attribute, but AMS looks for include_name?. The misnamed predicate was never called, so object.user.name was always serialized regardless…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - Medium 4.3
CVE-2026-44780 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, ReviewableQueuedPostSerializer unconditionally included payload["raw_email"] for posts that arrived via incoming email. Category moderation group members reaching the review queue could therefore read the full inbound email…
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - Medium 4.3
CVE-2026-44779 · Discourse
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, bot debug endpoints disclose whisper translation audit logs. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Published 12 Jun 2026 · Fixed in 2026.1.4, 2026.3.1, 2026.4.1 · NVD - High 7.2
CVE-2026-42306 · Docker Engine
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been…
Published 12 Jun 2026 · NVD - Medium 6.1
CVE-2026-41568 · Docker Engine
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1…
Published 12 Jun 2026 · NVD - High 7.2
CVE-2026-48165 · MariaDB
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node.…
Published 12 Jun 2026 · Fixed in 10.11.18, 11.4.12, 11.8.8 · NVD - High 7.2
CVE-2026-48163 · MariaDB
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary…
Published 12 Jun 2026 · Fixed in 10.11.18, 11.4.12, 11.8.8 · NVD - Medium 5.3
CVE-2026-44173 · MariaDB
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26,…
Published 12 Jun 2026 · Fixed in 10.11.17, 11.4.11, 11.8.7 · NVD - Medium 6.9
CVE-2026-44172 · MariaDB
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched…
Published 12 Jun 2026 · NVD - High 7.8
CVE-2026-44171 · MariaDB
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of…
Published 12 Jun 2026 · Fixed in 10.11.17, 11.4.11, 11.8.7 · NVD - Medium 6.3
CVE-2026-44170 · MariaDB
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell…
Published 12 Jun 2026 · Fixed in 10.11.17, 11.4.11, 11.8.7 · NVD - Medium 4.3
CVE-2026-44169 · MariaDB
MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2.
Published 12 Jun 2026 · Fixed in 11.4.11, 11.8.7 · NVD - High 8.0
CVE-2026-44168 · MariaDB
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary…
Published 12 Jun 2026 · Fixed in 10.11.17, 11.4.11, 11.8.7 · NVD - High 8.7
CVE-2026-11933 · MongoDB
A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod…
Published 12 Jun 2026 · Fixed in 8.0.26, 8.2.11, 8.3.4 · NVD - Critical 9.8
CVE-2026-49261 · MariaDB
MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now…
Published 11 Jun 2026 · Fixed in 10.11.18, 11.4.12, 11.8.8 · NVD - Medium 4.3
CVE-2026-9694 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary content via a specially crafted Service Desk email reply due to improper neutralization in email template processing.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - Medium 6.5
CVE-2026-9204 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to read arbitrary files from the Gitaly server and access internal network resources during repository import, due to insufficient validation of secondary URLs.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - High 8.7
CVE-2026-8589 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - High 7.5
CVE-2026-7250 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper input validation in the API request parsing middleware.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - Low 3.7
CVE-2026-6976 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to hide changes from merge request diff views due to improper input handling of file names.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - Medium 4.3
CVE-2026-6277 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with Security Manager-role permissions to manage project security configuration even when the relevant feature was in a disabled state, due to incorrect authorization enforcement.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - Medium 5.4
CVE-2026-6269 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to modify hidden merge requests due to incorrect authorization enforcements.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - Low 3.1
CVE-2026-3553 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to access confidential issue details due to incorrect authorization checks.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - Medium 6.5
CVE-2026-1500 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to cause denial of service due to uncontrolled resource consumption when processing a specially crafted file upload.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - Medium 4.3
CVE-2026-10733 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - High 8.7
CVE-2026-10087 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.
Published 11 Jun 2026 · Fixed in 18.10.8, 18.11.5, 19.0.2 · NVD - Medium 6.9
CVE-2026-49760 · Erlang/OTP
Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large…
Published 10 Jun 2026 · Fixed in 27.3.4.13, 28.5.0.2, 29.0.2 · NVD - High 8.8
CVE-2026-49759 · Erlang/OTP
Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk. The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote…
Published 10 Jun 2026 · Fixed in 27.3.4.13, 28.5.0.2, 29.0.2 · NVD - High 7.5
CVE-2026-48860 · Erlang/OTP
Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local…
Published 10 Jun 2026 · Fixed in 27.3.4.13, 28.5.0.2, 29.0.2 · NVD - Medium 6.3
CVE-2026-48859 · Erlang/OTP
Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication. When the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but…
Published 10 Jun 2026 · Fixed in 29.0.2 · NVD - Medium 6.3
CVE-2026-48858 · Erlang/OTP
Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it…
Published 10 Jun 2026 · Fixed in 27.3.4.13, 28.5.0.2, 29.0.2 · NVD - High 7.1
CVE-2026-48856 · Erlang/OTP
Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header…
Published 10 Jun 2026 · Fixed in 27.3.4.13, 28.5.0.2, 29.0.2 · NVD - Low 2.3
CVE-2026-48855 · Erlang/OTP
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd…
Published 10 Jun 2026 · Fixed in 27.3.4.13, 28.5.0.2, 29.0.2 · NVD - Unrated
CVE-2026-76549 · UpdraftPlus
UpdraftPlus: WP Backup & Migration Plugin: Cross-Site Request Forgery (CSRF)
Published 10 Jun 2026 · Fixed in 1.26.7 · WPVulnerability
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.