Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,544 results · page 26 of 351
Oct 12, 2026jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId oCVE-2026-109180 · Other software · jishenghua · reported by VulnCheckMedium 5.3
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.
- Product
- jshERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers tCVE-2026-108950 · Other software · opensource-socialnetwork · reported by VulnCheckMedium 6.9
Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.
- Product
- opensource-socialnetwork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal EliCVE-2026-105283 · Other software · ash-project · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbMedium 6.3
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for. AshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of
- Product
- ash_typescript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Oct 11, 2026pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass ACVE-2026-108905 · Other software · ph7software · reported by VulnCheckHigh 8.7
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.
- Product
- ph7builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplyCVE-2026-108903 · Other software · ph7software · reported by VulnCheckMedium 6.9
pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.
- Product
- ph7builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAutCVE-2026-108865 · Other software · AmoyLab · reported by VulnCheckHigh 8.8
AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials.
- Product
- Unla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface,CVE-2026-108863 · Other software · Katanemo · reported by VulnCheckHigh 8.7
Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config_dump endpoint to read configured LLM provider API keys in plaintext from the WASM filter configuration.
- Product
- Plano
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded CVE-2026-108860 · Other software · SciSharp · reported by VulnCheckCritical 9.3
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.
- Product
- BotSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memoryCVE-2026-108859 · Other software · mark3labs · reported by VulnCheckHigh 8.7
mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.
- Product
- mcp-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disabCVE-2026-108852 · Other software · OvidijusParsiunas · reported by VulnCheckLow 2.1
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.
- Product
- Deep Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by CVE-2026-108850 · Other software · guy-hartstein · reported by VulnCheckMedium 6.9
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in report_content to make the server fetch internal or external hosts, leaking image responses in returned PDFs and probing reachability.
- Product
- company-research-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silCVE-2026-108760 · Other software · llama-farm · reported by VulnCheckHigh 7.2
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.
- Product
- llamafarm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appoinCVE-2026-108758 · Other software · alextselegidis · reported by VulnCheckHigh 8.8
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.
- Product
- easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingCVE-2026-108755 · Other software · hatchet-dev · reported by VulnCheckMedium 6.9
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.
- Product
- hatchet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauCVE-2026-108748 · Other software · quarkiverse · reported by VulnCheckMedium 6.9
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.
- Product
- quarkus-langchain4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaCVE-2026-108739 · Other software · openagents-org · reported by VulnCheckHigh 8.7
OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.
- Product
- OpenAgents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus CVE-2026-108736 · Other software · alexjustesen · reported by VulnCheckMedium 6.3
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.
- Product
- speedtest-tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download prCVE-2026-108729 · Other software · cortezaproject · reported by VulnCheckHigh 8.2
Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.
- Product
- corteza
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews becauCVE-2026-108724 · Other software · Sylius · reported by VulnCheckMedium 6.9
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.
- Product
- Sylius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text withoCVE-2026-108723 · Other software · QingYunA · reported by VulnCheckLow 2
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.
- Product
- answer-me-with-html
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026Web Vitals Tracking: Does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative pageCVE-2026-87760 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.
- Product
- Web Vitals Tracking
- Affected
- up to 5.4.2
- What to do
- Affects up to 5.4.2. Update Web Vitals Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026click5 CRM add-on to Contact Form 7: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84261 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
- Product
- click5 CRM add-on to Contact Form 7
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update click5 CRM add-on to Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026click5 CRM add-on to Gravity Forms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84260 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
- Product
- click5 CRM add-on to Gravity Forms
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update click5 CRM add-on to Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026click5 CRM add-on to WPForms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84259 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
- Product
- click5 CRM add-on to WPForms
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update click5 CRM add-on to WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026click5 CRM add-on to Ninja Forms: Does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin pageCVE-2026-84258 · WordPress plugins & themes · reported by WPScanHigh 8.8
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
- Product
- click5 CRM add-on to Ninja Forms
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update click5 CRM add-on to Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Tcard WP: Does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actionsCVE-2026-81420 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Tcard WP
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Tcard WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WooCommerce Bookings: Does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actionsCVE-2026-14854 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.
- Product
- WooCommerce Bookings
- Fixed in
- 3.11.0
- What to do
- Update WooCommerce Bookings to 3.11.0 or newer.
Oct 10, 2026Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endCVE-2026-108707 · Other software · WuKongOpenSource · reported by VulnCheckCritical 9.3
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
- Product
- Wukong_HRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.CVE-2026-81797 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.CVE-2026-78535 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.CVE-2026-78534 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.CVE-2026-78533 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.CVE-2026-78532 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
- Affected
- up to 8.3
- What to do
- Affects up to 8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.CVE-2026-78531 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
- Affected
- up to 2.22
- What to do
- Affects up to 2.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.CVE-2026-78529 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
- Affected
- up to 3.11
- What to do
- Affects up to 3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.CVE-2026-66569 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.CVE-2026-66568 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.CVE-2026-66567 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.CVE-2026-66566 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.CVE-2026-66565 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.CVE-2026-66564 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
- Affected
- up to 3.0.14
- What to do
- Affects up to 3.0.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.CVE-2026-66563 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
- Affected
- up to 2.10
- What to do
- Affects up to 2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.CVE-2026-66483 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
- Affected
- up to 3.6.12
- What to do
- Affects up to 3.6.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.CVE-2026-66482 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026YITH WooCommerce Product Add-Ons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-66480 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.
- Product
- YITH WooCommerce Product Add-Ons
- Affected
- up to 4.34.0
- What to do
- Affects up to 4.34.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.CVE-2026-65459 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
- Affected
- up to 1.57.3
- What to do
- Affects up to 1.57.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.CVE-2026-62125 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.CVE-2026-62124 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
- Affected
- up to 2.21
- What to do
- Affects up to 2.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.CVE-2026-62123 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
- Affected
- up to 2.18
- What to do
- Affects up to 2.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.CVE-2026-62120 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
- Affected
- up to 3.20
- What to do
- Affects up to 3.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.