Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,302 results · page 23 of 767
Oct 10, 2026Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).CVE-2026-103501 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of entries to copy into a fixed buffer of 8 entries, without checking it against the buffer's capacity. A crafted sketch could cause a write of up to 988 bytes past the end of this internal heap buffer. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 1.0.0-incubating before 5.3.0. Only applications that deserialize HLL sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
- Product
- Apache DataSketches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Oct 10, 2026Balance: Deserialization of Untrusted DataCVE-2026-93945 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
- Product
- Balance
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update Balance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Camelia: Deserialization of Untrusted DataCVE-2026-93944 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
- Product
- Camelia
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update Camelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Convex: Deserialization of Untrusted DataCVE-2026-93943 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
- Product
- Convex
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update Convex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Dwell: Deserialization of Untrusted DataCVE-2026-93942 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
- Product
- Dwell
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update Dwell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Edema: Deserialization of Untrusted DataCVE-2026-93941 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
- Product
- Edema
- Affected
- up to 1.2.2.2
- What to do
- Affects up to 1.2.2.2. Update Edema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Greeny: Deserialization of Untrusted DataCVE-2026-93940 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
- Product
- Greeny
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update Greeny to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Hogwords: Deserialization of Untrusted DataCVE-2026-93938 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
- Product
- Hogwords
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Hogwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Hygia: Deserialization of Untrusted DataCVE-2026-93937 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
- Product
- Hygia
- Affected
- up to 1.21.0
- What to do
- Affects up to 1.21.0. Update Hygia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026IPharm: Deserialization of Untrusted DataCVE-2026-93936 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
- Product
- IPharm
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update IPharm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Let's Play: Deserialization of Untrusted DataCVE-2026-93935 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
- Product
- Let's Play
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update Let's Play to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Partiso: Deserialization of Untrusted DataCVE-2026-93934 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
- Product
- Partiso
- Affected
- up to 1.1.13
- What to do
- Affects up to 1.1.13. Update Partiso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Rosalinda: Deserialization of Untrusted DataCVE-2026-93933 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
- Product
- Rosalinda
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Rosalinda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Smart Casa: Deserialization of Untrusted DataCVE-2026-93932 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
- Product
- Smart Casa
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update Smart Casa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Smash: Deserialization of Untrusted DataCVE-2026-93931 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
- Product
- Smash
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update Smash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Tantra: Deserialization of Untrusted DataCVE-2026-93930 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
- Product
- Tantra
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update Tantra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Travesia: Deserialization of Untrusted DataCVE-2026-93929 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
- Product
- Travesia
- Affected
- up to 1.1.16
- What to do
- Affects up to 1.1.16. Update Travesia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Veto: Deserialization of Untrusted DataCVE-2026-93927 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
- Product
- Veto
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Veto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Gutentype: Deserialization of Untrusted DataCVE-2026-62046 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
- Product
- Gutentype
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update Gutentype to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Booklovers: Deserialization of Untrusted DataCVE-2026-62045 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
- Product
- Booklovers
- Affected
- up to 2.13.0
- What to do
- Affects up to 2.13.0. Update Booklovers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026WPCOM Member: Authentication BypassCVE-2026-104803 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore), then issue a second GET request triggering `weapp_new_user()` to read that forged entry and resolve the attacker-supplied `openid` value to a bound WordPress account before `wp_set_auth_cookie()` establishes a fully authenticated session. This makes it possible for unauthenticated attackers to log in as any WordPress user — including administrators — whose bound social provider identifier (openid/unionid) is known or discoverable. Successful exploitation requires that the target site has at least one social provider configured (which activates the vulner
- Product
- WPCOM Member
- Affected
- up to 1.7.27
- What to do
- Affects up to 1.7.27. Update WPCOM Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026PPOM – Product Addons & Custom Fields for WooCommerce: Arbitrary file deletionCVE-2026-104801 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server.
- Product
- PPOM – Product Addons & Custom Fields for WooCommerce
- Affected
- up to 34.0.10
- What to do
- Affects up to 34.0.10. Update PPOM – Product Addons & Custom Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Avada (Fusion) Builder: Authorization bypassCVE-2026-97670 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data token; the 3.16.1 trust gate is_content_request_supplied() only inspects $_POST['args']/$_GET['args'], never the $_POST['formData'] the public form-submit endpoint parses). This makes it possible for unauthenticated attackers to invoke arbitrary WordPress action hooks (multiple per request), causing state changes up to permanent, irreversible destruction of site content: a verified unauthenticated request permanently deleted trashed posts, pages, and comments via the core wp_scheduled_delete action. Other non-deny-listed hooks extend the impact to denial of service (e.g. wp_maybe_auto_update) and, where vulnerable third-party handlers are installed, further privileged writes. The same unauthenticated dynamic-data pipeline additionally exposes a blind arbitrary user/post-meta read; the read res
- Product
- Avada (Fusion) Builder
- Affected
- up to 7.16.1
- What to do
- Affects up to 7.16.1. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordavada.comwordfence.com
Oct 10, 20263D Product configurator for WooCommerce: Remote Code ExecutionCVE-2026-103889 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template with PHP execution enabled. This makes it possible for unauthenticated attackers to execute code on the server. The only nonce and authentication check in the handler is entirely enclosed in a block comment with no replacement, making the endpoint reachable via a single unauthenticated POST to any URL on the site.
- Product
- 3D Product configurator for WooCommerce
- Affected
- up to 2.16.2
- What to do
- Affects up to 2.16.2. Update 3D Product configurator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection): Arbitrary File UploadCVE-2026-94589 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload directory and a sanitize_file_name() bypass that converts shell.php- into shell.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
- Product
- Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Blocksy Companion: Privilege escalationCVE-2026-107645 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.
- Product
- Blocksy Companion
- Affected
- up to 2.1.58
- What to do
- Affects up to 2.1.58. Update Blocksy Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Advanced IP Blocker: Authentication BypassCVE-2026-104732 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compounding this, an error branch in the function unconditionally mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a `Location` header to any unauthenticated caller, after which `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML — both nonces computed against a fixed `uid=0` empty-session context and therefore fully reusable by the attacker across subsequent requests. This makes it possible for unauthenticated attackers to bypass authentication entirely for any 2FA-enabled account, including administrators, by brute-forcing an unthrottled 6-digit TOTP code (no attempt counter, no account lockout, and no `wp_login_failed` firing) and receiving a fully authenticated session cookie via `wp_set_auth_cookie` without ever supplying the
- Product
- Advanced IP Blocker
- Affected
- up to 8.13.13
- What to do
- Affects up to 8.13.13. Update Advanced IP Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2026In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functionsCVE-2026-108474 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.8
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
- Product
- Exposed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections.CVE-2026-108269 · Other software · Privasys · reported by GitHubCritical 9.1
Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.
- Product
- ra-tls-clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation.CVE-2026-108268 · Other software · Privasys · reported by GitHubCritical 9.1
Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.
- Product
- enclave-os-virtual
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls.CVE-2026-108267 · Other software · Privasys · reported by GitHubCritical 9.1
Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.
- Product
- go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support.CVE-2026-108266 · Other software · Privasys · reported by GitHubCritical 9.1
Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1.
- Product
- rustls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves.CVE-2026-108265 · Other software · Privasys · reported by GitHubCritical 9.1
Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.
- Product
- enclave-os-mini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers.CVE-2026-108264 · Other software · wizarrrr · reported by GitHubCritical 9.1
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator importing an untrusted bundle through POST /settings/wizard/import, could execute arbitrary Python when GET /wizard/{server}/{idx} rendered the stored step; app/jinja_filters.py and app/services/wizard_widgets.py contained additional evaluation sinks. This could execute operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected service credentials and the database, and produce stored cross-site scripting. This issue is fixed in 2026.9.1.
- Product
- wizarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Astron Agent is an agentic workflow platform for building and running AI agents.CVE-2026-108263 · Other software · iflytek · reported by GitHubCritical 9.9
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.
- Product
- astron-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Tina is a headless content management system.CVE-2026-108261 · Other software · tinacms · reported by GitHubCritical 9.3
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.CVE-2026-78797 · Other software · reported by MITRECritical 9.8
An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoc.linkease.comfw.koolcenter.com
Oct 9, 2026Contao is an Open Source CMS.CVE-2026-107845 · Other software · contao · reported by GitHubCritical 9.3
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.
- Product
- contao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.CVE-2026-78835 · Other software · reported by MITRECritical 9.8
Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrocket.comredteam-pentesting.de
Oct 9, 2026x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP.CVE-2026-107824 · Other software · duty1g · reported by GitHubCritical 9.3
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated network client that can reach the default port, 9094 for x64 or 9095 for x32, can execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. This issue is fixed in version 1.1.
- Product
- x64dbg-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts bCVE-2026-108157 · Other software · smp46 · reported by VulnCheckCritical 9.2
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
- Product
- pingvin-share-x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary coCVE-2026-78796 · Other software · reported by MITRECritical 9.8
An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\cgi-bin\upgrade file
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compastebin.com
Oct 9, 2026Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file.CVE-2026-39460 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.3
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware oCVE-2026-33367 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.3
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.CVE-2026-32645 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.2
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption.CVE-2026-28745 · Other software · Red Lion Controls · reported by ics-cert@hq.dhs.govCritical 9.3
Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.
- Product
- 700 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.CVE-2026-15340 · Other software · Savannah · reported by ics-cert@hq.dhs.govCritical 9.3
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
- Product
- lwIP SMTP client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unautheCVE-2026-108109 · Other software · hotspotbilling · reported by VulnCheckCritical 9.3
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
- Product
- phpnuxbill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameCVE-2026-108107 · Other software · hotspotbilling · reported by VulnCheckCritical 9.3
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
- Product
- phpnuxbill
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Nginx UI is a web user interface for the Nginx web server.CVE-2026-107806 · Other software · 0xJacky · reported by GitHubCritical 9.4
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.
- Product
- nginx-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.