Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331,678 results · page 27 of 6634
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runsCVE-2026-123306 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.4
In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote hostCVE-2026-123305 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck pathCVE-2026-123304 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possibleCVE-2026-123301 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.2
In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappingsCVE-2026-123300 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.7
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possibleCVE-2026-123299 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.1
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possibleCVE-2026-123298 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flowCVE-2026-123297 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.8
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possibleCVE-2026-123296 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpointCVE-2026-123295 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flowCVE-2026-123294 · Other software · JetBrains · reported by cve@jetbrains.comCritical 9.6
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
- Product
- Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path settingCVE-2026-123293 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.8
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebookCVE-2026-123291 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpointCVE-2026-123290 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify filesCVE-2026-123289 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor linkCVE-2026-123288 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reportsCVE-2026-123287 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session tokenCVE-2026-123286 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injectionCVE-2026-123285 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared contentCVE-2026-123284 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated sessionCVE-2026-123282 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.4
In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount brokerCVE-2026-123281 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reportsCVE-2026-123280 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
- Product
- Datalore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpointCVE-2026-123278 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.7
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on LinuxCVE-2026-123277 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5
In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux
- Product
- CLion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026undici is an HTTP client for Node.js.CVE-2026-116630 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.9
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached response that is revalidated with a conditional request can be validated by a 304 Not Modified from a different origin. When the origin that stored the response redirects the conditional revalidation request to another origin, the redirect handler strips origin-bound credential headers but not the cache-generated If-None-Match or If-Modified-Since validators, so the redirect destination receives the original origin's validator and undici treats its 304 as successful revalidation of the stored representation. As a result, a shared cache can serve the original origin's stored authenticated response, including one gated by Authorization, to a later unauthenticated caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Nov 6, 2026Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process mCVE-2026-115701 · Other software · ninenines · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.2
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cowboy_http:parse/2 in src/cowboy_http.erl appends every further byte that arrives on the keep-alive connection to the connection buffer and returns to the receive loop without parsing it. The socket stays in active mode and no limit applies to this buffer: max_request_line_length, max_headers and the other parser limits only take effect once the handler returns and parsing resumes, and the only timer in this state is idle_timeout (default 60 seconds), which is reset on every received chunk. A client can therefore send an arbitrary amount of data on one connection for as long as the handler runs, and a few connections to an endpoint that holds requests open can drive the Erlang VM into out-of-memory conditions. This issue affects cowboy: from 2.18.0 before 2.21.0.
- Product
- cowboy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Nov 6, 2026Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 CVE-2026-113431 · Other software · ninenines · reported by 6b3ad84c-e1a6-4bf7-a703-f496b71e49dbHigh 8.7
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machine.erl decodes every HEADERS block with cow_hpack:decode/3. It bounds the compressed block size and the number of fields, but not the size of the decoded header list that RFC 9113 section 6.5.2 places under SETTINGS_MAX_HEADER_LIST_SIZE. A peer stores one header value of up to the dynamic table size (4096 bytes by default) and then references it with one-byte indexed fields, so about 100 bytes on the wire decode to a header list of about 390 KB. A consumer that copies the decoded values, as Cowboy does when cowboy_http2:headers_to_map/2 joins repeated cookie fields into one binary, allocates that amount for every stream. The total across streams and connections is not bounded. This issue affects cowlib: from 2.7.0 before 2.22.0.
- Product
- cowlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.erlef.orggithub.com
Nov 6, 2026Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels: PHP Code InjectionCVE-2026-87964 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.
- Product
- Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels
- Affected
- up to 8.0.26
- What to do
- Affects up to 8.0.26. Update Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2026A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authoriCVE-2026-33379 · Other software · Grafana · reported by security@grafana.comHigh 8.5
A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.
- Product
- Grafana OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Redirection for Contact Form 7: Authorization bypassCVE-2026-120659 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.
- Product
- Redirection for Contact Form 7
- Affected
- up to 3.2.14
- What to do
- Affects up to 3.2.14. Update Redirection for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2026undici is an HTTP client for Node.js.CVE-2026-120474 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 6.5
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original request's cache key. That key omits the credential and carries no Vary header, so a later anonymous or different user can be served the first user's private response body. This results in cross-user disclosure of cached private responses. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Nov 6, 2026undici is an HTTP client for Node.js.CVE-2026-120423 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.9
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. An integrity value whose digest is preceded by a tab or other ASCII whitespace is parsed as a single unrecognized token and skipped, and when no recognized algorithm remains undici treats the integrity list as empty and accepts the response, so a server returning a body different from the pinned digest passes the check. An application that pins a response with a valid but whitespace-surrounded SRI value receives attacker-controlled bytes with no integrity error, and the attacker needs only to control the response body, not the integrity metadata. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Nov 6, 2026undici is an HTTP client for Node.js.CVE-2026-120415 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.9
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin, but when request headers are supplied as an array of name and value tuples (a valid documented input, for example from Object.entries), the redirect handler misreads them as a flat list so the header names never match and the sensitive headers are not removed. If a header-normalizing interceptor such as cache or deduplicate is composed outside the redirect interceptor, it then serializes the retained headers onto the cross-origin request, disclosing the caller's origin-bound credentials to the unrelated redirect destination. This is a representation-dependent bypass of the cross-origin header stripping added in CVE-2024-30260. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply request headers as a plain object or a flat name and value array rather than an array of tuples, or compose the redirect interceptor outside the normalizing interceptor.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Nov 6, 2026undici is an HTTP client for Node.js.CVE-2026-120222 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbMedium 5.9
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed with a downstream handler that throws during response processing (such as the built-in dump interceptor exceeding its maxSize, or the decompress interceptor rejecting more than five Content-Encoding values), a throw raised asynchronously while a cached response is replayed escapes as an uncaught exception or unhandled promise rejection and terminates the Node.js process. A malicious or compromised HTTP server can crash any such client by serving a cacheable response that triggers the throw on replay, including on a 304 revalidation of a stale entry, so the impact is availability only. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, avoid composing the cache interceptor with a response handler that throws during response processing until upgrading.
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Nov 6, 2026undici is an HTTP client for Node.js.CVE-2026-116592 · Other software · undici · reported by ce714d77-add3-4f53-aff5-83d477b104bbHigh 7.4
undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent composes the redirect and shared cache interceptors, undici decides whether to store the final response under the original request key by inspecting only the final redirect hop, which bypasses the earlier fix for CVE-2026-109829 that compared only the initial and final origins. A redirect that bounces through an untrusted origin and returns to the trusted origin is still cached under the trusted key, an intermediate hop's Vary is dropped so a response that varies on Authorization or Cookie can be served to a different user, and an intermediate hop's no-cache or default-uncacheable status is ignored so a non-storable redirect is laundered into a cacheable entry. An attacker who controls a redirect target from a trusted URL can poison the cached entry for that URL or have a private, per-user response served to a later caller. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, compose the interceptors as cache then redirect, use per-origin dispatchers and cache stores, or disable shared caching on redirec
- Product
- undici
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcna.openjsf.orggithub.com
Nov 6, 2026VOD Infomaniak: Authorization bypassCVE-2026-115831 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to initiate unauthorized video imports using the site owner's Infomaniak API credentials, consume the site owner's VOD account quota, and insert arbitrary rows into the wp_vod_upload table causing public shortcodes to resolve to attacker-chosen video content. This action is explicitly reserved for Contributor-level and above by the plugin's own role-rights system, meaning subscriber access is intentionally forbidden by design — the AJAX handler simply omits the enforcement.
- Product
- VOD Infomaniak
- Affected
- up to 1.5.15
- What to do
- Affects up to 1.5.15. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2026YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports: Time-based SQL InjectionCVE-2026-109977 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'params[searchKey]' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2026INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowiCVE-2026-19877 · Other software · INFINITT Healthcare · reported by vulnerability@ncsc.chHigh 7.5
INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and does not restrict repeated password attempts, allowing an unauthenticated remote attacker to brute-force the password within the link validity window and gain unauthorized access to shared medical images. Fixed in ULite 5.0.2.1 BN50.
- Product
- INFINITT ULite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated rCVE-2026-19876 · Other software · INFINITT Healthcare · reported by vulnerability@ncsc.chMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50.
- Product
- INFINITT ULite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input throughCVE-2026-123660 · Other software · vulnerability-lookup · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8Medium 5.3
In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchanged to Python's string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {"text": "{title:>999999999}"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested dee
- Product
- vulnerability-lookup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Travelly – Tour & Travel Booking Manager for WooCommerce: Authorization bypassCVE-2026-121794 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view stored WooCommerce payment gateway credentials — including PayPal API username, password, and signature, as well as Stripe test and live secret keys — injected verbatim into the HTML response of the tour edit screen. The credentials are present in the raw HTTP response regardless of the modal's CSS visibility state, making them trivially accessible by viewing page source.
- Product
- Travelly – Tour & Travel Booking Manager for WooCommerce
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Travelly – Tour & Travel Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 6, 2026Posts Table with Search & Sort: Stored Cross-Site ScriptingCVE-2026-118189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post at save time because it contains no literal angle bracket characters; the malicious HTML tags are only reconstructed at render time, making this exploitable by Contributors who would ordinarily lack the unfiltered_html capability.
- Product
- Posts Table with Search & Sort
- Affected
- up to 1.4.14
- What to do
- Affects up to 1.4.14. Update Posts Table with Search & Sort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2026Graphina – Charts and Graphs For Elementor: Stored Cross-Site ScriptingCVE-2026-110291 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iq_tree_chart_node_font_family (and any text control serialized into chart_data['settings'])' parameter in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Elementor's Utils::kses_post_deep() does not strip the attack payload on save because the payload contains no disallowed HTML tags — only a single quote and an event-handler fragment — allowing the malicious value to survive persistence.
- Product
- Graphina – Charts and Graphs For Elementor
- Affected
- up to 3.1.13
- What to do
- Affects up to 3.1.13. Update Graphina – Charts and Graphs For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2026The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.CVE-2026-108018 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.3
The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts.
- Product
- BigFix MCM & Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Nov 6, 2026Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the CheckmkCVE-2026-103682 · Other software · Checkmk GmbH · reported by security@checkmk.comLow 2
Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the Jolokia login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the CheCVE-2026-103674 · Other software · Checkmk GmbH · reported by security@checkmk.comLow 2
Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2026The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role fromCVE-2026-88801 · WordPress plugins & themes · reported by WPScanHigh 8
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts which execute when an administrator opens one of the standard user management screens.
- Affected
- up to 1.7.8.7
- What to do
- Affects up to 1.7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability checkCVE-2026-88800 · WordPress plugins & themes · reported by WPScanCritical 9.1
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.
- Affected
- up to 1.7.8.7
- What to do
- Affects up to 1.7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2026The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their cCVE-2026-88799 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administrator, resulting in a full account takeover.
- Affected
- up to 1.7.8.7
- What to do
- Affects up to 1.7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.