Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

24,571 results · page 10 of 492

Oct 16, 2026bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other uCVE-2026-111639 · Other software · mlogclub · reported by VulnCheckHigh 8.6
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.
Product
bbs-go
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes CVE-2026-111622 · Other software · a466350665 · reported by VulnCheckHigh 7.6
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
Product
smart-sso
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSCVE-2026-111606 · Other software · hcengineering · reported by VulnCheckHigh 8.6
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
Product
Huly Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belongingCVE-2026-111605 · Other software · dromara · reported by VulnCheckHigh 8.6
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
Product
Jpom
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.CVE-2026-109461 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Product
Microsoft Identity Client for NodeJS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59967 · Other software · TandoorRecipes · reported by GitHubMedium 5.4
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another member's pending bookmarklet identifier to POST /api/recipe-from-source/. Request processing uses api/recipe-from-source/, BookmarkletImport, filter, delete. The attack works because the endpoint parses and returns the victim's stored URL and captured page content, then unconditionally deletes the victim's pending import. This can disclose authenticated or private captured page content and destroy another Space member's pending import. This issue is fixed in version 2.6.10.
Product
recipes
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2026-59962 · Other software · TandoorRecipes · reported by GitHubMedium 6.5
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored CustomFilter ordering values. Request processing uses _finalize_ordering and order_by through 8080/api/recipe/ and 8080/api/recipe-book/. The attack works because Django interprets double-underscore ordering fields as related-table traversal, and observable result ordering leaks values from related User fields. This can infer password hashes, email addresses, administrator status, and other related database values. This issue is fixed in version 2.6.10.
Product
recipes
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026Discourse Doc Categories is a plugin for organizing Discourse topics as documentation.CVE-2026-57447 · Other software · discourse · reported by GitHubMedium 4.3
Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the index topic can use this behavior to learn titles that the user is not authorized to view, although the advisory does not establish access to topic contents. This vulnerability is addressed by commit b15d4de02ad29d7c9525346afee51fef4a2c605a.
Product
discourse-doc-categories
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2026An issue was discovered in GStreamer gst-plugins-good before 1.28.2.CVE-2026-46472 · Other software · reported by MITREHigh 7.5
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gstreamer.freedesktop.org
Oct 16, 2026An issue was discovered in GStreamer gst-plugins-good before 1.28.2.CVE-2026-46471 · Other software · reported by MITREMedium 5.5
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com gstreamer.freedesktop.org
Oct 16, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-110703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to own a published listing, as the ownership check in GeoDir_Post_Data::can_edit() limits who can store the payload; however, because ajax_save_post() re-applies the existing post_status, edits to an already-published listing bypass re-moderation and remain live immediately.
Product
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Affected
up to 2.8.191
What to do
Affects up to 2.8.191. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026User Registration PRO – Custom Registration Form, Login Form, and User Profile: Stored Cross-Site ScriptingCVE-2026-87111 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.
Product
User Registration PRO – Custom Registration Form, Login Form, and User Profile
Affected
up to 6.2.9
What to do
Affects up to 6.2.9. Update User Registration PRO – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpuserregistration.com wordfence.com
Oct 16, 2026The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder pluCVE-2026-15222 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Affected
up to 5.2.8
What to do
Affects up to 5.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-111069 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The client-side HTML pattern attribute enforcing alphanumeric-only input on the twitterusername field is not validated server-side, allowing a listing owner with Subscriber-level access to submit an attribute-breakout payload that bypasses sanitization and is stored directly to the custom field table.
Product
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Affected
up to 2.8.192
What to do
Affects up to 2.8.192. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 16, 2026OTP Login & Register Woocommerce: Does not adequately limit one-time-password verification attemptsCVE-2026-110135 · WordPress plugins & themes · reported by WPScanHigh 7.4
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.
Product
OTP Login & Register Woocommerce
Fixed in
2.7.3
What to do
Update OTP Login & Register Woocommerce to 2.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026WP Mail Logging: Sensitive Information ExposureCVE-2026-109401 · WordPress plugins & themes · reported by WordfenceLow 2.7
The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.
Product
WP Mail Logging
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update WP Mail Logging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Photo Engine (Media Organizer & Lightroom): Authorization bypassCVE-2026-107770 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wp_delete_attachment and upload new attachments to the site, actions that require the upload_files or edit_others_posts capabilities. A Subscriber-level user can obtain their own wplr_auth_token directly from the profile.php page source, because the admin screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, causing wp_localize_script to leak the token into every admin page view; this token can then be used from a cookie-less HTTP session to invoke destructive actions on the /?wplr-sync-api endpoint.
Product
Photo Engine (Media Organizer & Lightroom)
Affected
up to 6.5.6
What to do
Affects up to 6.5.6. Update Photo Engine (Media Organizer & Lightroom) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026Theme My Login: Privilege escalationCVE-2026-89079 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
Product
Theme My Login
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2026SiteOrigin CSS: Stored DOM-Based Cross-Site ScriptingCVE-2026-111122 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the malicious comment to be approved and an administrator to subsequently open the Visual Inspector and click the attacker's anchor link, both of which are plausible interactions during routine comment triage.
Product
SiteOrigin CSS
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update SiteOrigin CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 16, 2026The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPCVE-2026-109513 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has previously enabled a WordPress.org Reviews campaign and placed the notificationx-pro/notificationx dynamic block on a public page, both of which are documented, supported plugin workflows.
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026SiteOrigin CSS: Stored DOM-Based Cross-Site ScriptingCVE-2026-107764 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because WordPress core's esc_url() preserves HTML entity-encoded characters, allowing a crafted entity-encoded payload in the comment 'Website' field to survive storage and be DOM-decoded by the browser into executable markup at the sink.
Product
SiteOrigin CSS
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update SiteOrigin CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 16, 2026The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated: Arbitrary shortcode executionCVE-2026-104001 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. A Subscriber-level user need only save the shortcode payload to their own Biographical Info field via the REST API or wp-admin profile page; the shortcode then executes on any unauthenticated front-end request that resolves that author's description, such as requests using the ?author= query parameter when auto_redirection is disabled.
Product
The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
Affected
up to 4.11.1
What to do
Affects up to 4.11.1. Update The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 16, 2026InstaWP Connect – 1-click WP Staging & Migration: Privilege EscalationCVE-2026-109400 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the required capability — which WordPress resolves as a real capability match for any user holding that role — combined with `generate_section_field()` rendering the master API key from the `instawp_api_options` option directly as the `value` attribute of a plain-text HTML input with no additional `manage_options` or equivalent capability check. This makes it possible for authenticated attackers with Subscriber-level access and above to read the plaintext master API key, use its SHA-256-derived secret as a bearer token accepted by the plugin's REST API `validate_api_request()`, and call `POST /wp-json/instawp-connect/v2/auto-login` to mint a 30-second single-use login URL that sets an administrator authentication cookie — fully escalating their privileges. Exploitation requires the site to be actively connected to InstaWP and an administrator to have added the attacker's role t
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.4.1
What to do
Affects up to 0.1.4.1. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026miniOrange OTP Login, Verification and SMS Notifications: Authentication BypassCVE-2026-103895 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.
Product
miniOrange OTP Login, Verification and SMS Notifications
Affected
up to 5.5.8
What to do
Affects up to 5.5.8. Update miniOrange OTP Login, Verification and SMS Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2026RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Stored Cross-Site ScriptingCVE-2026-109207 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 5.2.11
What to do
Affects up to 5.2.11. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Oct 15, 2026go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords.CVE-2026-111347 · Other software · opsre · reported by VulnCheckHigh 8.2
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.
Product
go-ldap-admin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 15, 2026nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is neveCVE-2026-111275 · Other software · NIFTI-Imaging · reported by VulnCheckMedium 6.9
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.
Product
nifti_clib
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 15, 2026FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked CVE-2026-111149 · Other software · danoli3 · reported by VulnCheckMedium 6.9
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.
Product
FreeImage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 15, 2026Login with phone number: Missing AuthorizationCVE-2026-110374 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
Product
Login with phone number
Affected
up to 1.8.77
What to do
Affects up to 1.8.77. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026AI Engine: Missing AuthorizationCVE-2026-110888 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.
Product
AI Engine
Affected
up to 3.8.3
What to do
Affects up to 3.8.3. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2026Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard daCVE-2026-110812 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9.4
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)
Product
Amazon Neptune Engine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aws.amazon.com docs.aws.amazon.com
Oct 15, 2026In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falCVE-2026-102631 · Other software · Canonical · reported by security@ubuntu.comMedium 5.9
In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login. This allows the new user to access and modify files belonging to the previous user, including credentials such as SSH keys and cloud API tokens, and silently rebinds the local account record to the new identity. As a mitigation, administrators should lock or delete the previous user's local authd account when the corresponding IdP account is removed.
Product
authd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net github.com
Oct 15, 2026A flaw was found in Ansible Operator Plugins.CVE-2026-92982 · Other software · Red Hat · reported by Red HatHigh 8.5
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.
Product
Red Hat Ansible Automation Platform 2.6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Oct 15, 2026AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.CVE-2026-104586 · Other software · reported by MITRECritical 9.8
AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 15, 2026P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configurCVE-2026-103508 · Other software · Perforce · reported by security@puppet.comHigh 7.3
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier. Perforce resolved it in 2026.4.3.
Product
P4 (Helix core)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.perforce.com
Oct 15, 2026WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices: Limited Privilege EscalationCVE-2026-8145 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.
Product
WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2026An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.CVE-2026-19863 · Other software · reported by emo@eclipse.orgCritical 9.3
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com gitlab.eclipse.org
Oct 15, 2026In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a sCVE-2026-93483 · Other software · Znuny · reported by MITRECritical 9.5
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.
Product
Znuny
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record znuny.org znuny.org
Oct 14, 2026Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sCVE-2026-110864 · Other software · better-auth · reported by VulnCheckCritical 9.1
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can obtain encrypted state for a fake profile with a victim's verified email to take over the account via implicit linking.
Product
better-auth
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 14, 2026A vulnerability has been found in OAID Tengine up to 1.12.0.CVE-2026-110694 · Other software · OAID · reported by VulDBLow 2.1
A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/serializer/tmfile/tm2_serializer.c of the component tmfile Model Loader. Such manipulation of the argument offset_root leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Product
Tengine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 14, 2026LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g.CVE-2026-55167 · Other software · LDAPAccountManager · reported by GitHubMedium 4.2
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who has already completed valid password authentication can therefore retain the same signed WebAuthn ceremony state instead of consuming it once. The practical risk is limited by the requirement for a valid password, the same PHP session, and a valid authenticator signature. This issue is fixed in version 9.6.
Product
lam
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 14, 2026Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base fCVE-2026-110775 · Other software · ModelEngine-Group · reported by VulnCheckHigh 7.1
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents.
Product
nexent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 14, 2026holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tCVE-2026-110769 · Other software · holaboss-ai · reported by VulnCheckHigh 8.3
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
Product
holaOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 14, 2026Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow.CVE-2026-109506 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 5.9
Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device’s web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login. Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.
Product
RE190 v5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tp-link.com tp-link.com
Oct 14, 2026dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.CVE-2026-100406 · Other software · dbt-labs · reported by GitHubHigh 8.2
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.
Product
dbt-core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 14, 2026FOG is a free open-source cloning/imaging/rescue suite/inventory management system.CVE-2026-54554 · Other software · FOGProject · reported by GitHubHigh 7.5
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.
Product
fogproject
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 14, 2026Best Payments Plugin for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-108484 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
Product
Best Payments Plugin for WP
Affected
up to 4.6.27
What to do
Affects up to 4.6.27. Update Best Payments Plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 14, 2026An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 CVE-2026-102077 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.7
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On MX Series with SPC3 line-card and source NAT configuration, when a specific malformed IPv6 packet is received, it is not dropped but instead a session is created and NAT resources are allocated. Continued receipt of such packets will eventually lead to session or resource exhaustion, which will impact all traffic through the device. To recover the device needs to be rebooted. To monitor session usage, use the following: show services sessions summary To monitor source NAT resource usage, use the following: show services nat pool This issue affects Junos OS on MX Series with SPC3: * All versions before 23.2R2-S4; * 23.4 versions before 23.4R2-S5; * 24.2 versions before 24.2R2.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net
Oct 14, 2026RabbitMQ is a messaging and streaming broker.CVE-2026-67418 · Other software · rabbitmq · reported by GitHubMedium 5.3
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a separately authenticated matching subscriber. When the subscriber path serializes the outbound PUBLISH, serialise_prop/2 has no matching clause, and the uncontained function_clause exception closes the victim MQTT or Web MQTT connection. The publisher connection and broker remain available, and queued replay, retained-message persistence, and broker-wide denial of service were not established. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
Product
rabbitmq-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 14, 2026A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to causeCVE-2026-102086 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.2
A NULL Pointer Dereference vulnerability in the DNS plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS). When multiple DNS queries are received in a single flow session, where one query matches a Security Intelligence (SecIntel) feed and another query is sent for DNS Domain Generation Algorithm (DGA) analysis, an error in processing logging of these asynchronous tasks can lead to an FPC crash. The exact timing conditions are outside an attacker's direct control. This issue affects Junos OS on SRX Series: * All versions before 23.2R2-S7.7; * from 23.4 before 23.4R2-S8.13; * from 24.2 before 24.2R2-S5.5; * from 24.4 before 24.4R2-S4; * from 25.2 before 25.2R2-S1; * from 25.4 before 25.4R1-S2.
Product
Junos OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.juniper.net

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.