Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

420new WordPress flaws this week

399,200entries in the database

399,200 results · page 449 of 7984

Oct 7, 2026Pix por Piggly (para Woocommerce): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42714 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2.
Product
Pix por Piggly (para Woocommerce)
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Pix por Piggly (para Woocommerce) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Post title marquee scroll: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42713 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9.
Product
Post title marquee scroll
Affected
up to 9.9
What to do
Affects up to 9.9. Update Post title marquee scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL queryCVE-2026-103668 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpHigh 8.8
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.
Product
Movable Type Cloud Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp movabletype.org
Oct 7, 2026Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-97294 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.
Product
Media LIbrary Assistant
Affected
up to 3.41
What to do
Affects up to 3.41. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod.CVE-2026-97146 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.8
Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments. The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Product
Apache YuniKorn
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 7, 2026Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks.CVE-2026-92393 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 2
Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE action correctly enforces the checks for all object types. The bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Product
Apache YuniKorn
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 7, 2026Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDACVE-2026-78243 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 2.1
Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=". This only affects install that have the non default LDAP group provider configured. Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Product
Apache YuniKorn
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 7, 2026affiliate-toolkit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42721 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1.
Product
affiliate-toolkit
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update affiliate-toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Dynamic User Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42720 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4.
Product
Dynamic User Directory
Affected
up to 2.4
What to do
Affects up to 2.4. Update Dynamic User Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026WP Rentals: Missing AuthorizationCVE-2026-27434 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rentals: from n/a through 3.14.2.
Product
WP Rentals
Affected
up to 3.14.2
What to do
Affects up to 3.14.2. Update WP Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Rocket Lazy Load: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0.
Product
Rocket Lazy Load
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Rocket Lazy Load to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Modula Image Gallery: Missing AuthorizationCVE-2026-105876 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.
Product
Modula Image Gallery
Affected
up to 3.0.11
What to do
Affects up to 3.0.11. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Prime Slider – Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105875 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.
Product
Prime Slider – Addons For Elementor
Affected
up to 4.6.2
What to do
Affects up to 4.6.2. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105873 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Product
Element Pack Elementor Addons
Affected
up to 8.8.6
What to do
Affects up to 8.8.6. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Element Pack Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105871 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
Product
Element Pack Elementor Addons
Affected
up to 8.8.6
What to do
Affects up to 8.8.6. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks.CVE-2026-105192 · Other software · LMCache · reported by reefs@jfrog.comCritical 9.8
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect. The decode path shipped in v0.3.9 and is present through v0.5.5, including the v0.5.6 release candidates. v0.5.6, published on 2026-10-14, removes pickle.loads from this path.
Product
LMCache
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.lmcache.ai github.com
Oct 7, 2026Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104393 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.
Product
Happy Addons for Elementor
Affected
up to 3.50.0
What to do
Affects up to 3.50.0. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104391 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
Product
Quiz And Survey Master
Affected
up to 11.2.7
What to do
Affects up to 11.2.7. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Booktics: Missing AuthorizationCVE-2026-104390 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.
Product
Booktics
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Hustle: Missing AuthorizationCVE-2026-103075 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.
Product
Hustle
Affected
up to 7.8.14.2
What to do
Affects up to 7.8.14.2. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 7, 2026Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resCVE-2026-97720 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT. Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
Product
Apache Impala
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 7, 2026An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's broCVE-2026-93684 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79). Users are recommended to upgrade to version 4.5.3.
Product
Apache Impala
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 7, 2026This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.CVE-2026-93026 · Other software · Veeam · reported by support@hackerone.comMedium 6.1
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 7, 2026Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specifiCVE-2026-90466 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'. The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin. Users are recommended to upgrade to version 4.5.3, which fixes this issue.
Product
Apache Impala
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Oct 7, 2026OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: Stored Cross-Site ScriptingCVE-2026-89417 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the front-end server serves the retained .tmp file without a Content-Type or X-Content-Type-Options header, enabling MIME-sniffing browsers such as Chromium to execute the injected script — a condition present by default on many Apache and nginx/php-fpm deployments.
Product
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Affected
up to 6.3.10
What to do
Affects up to 6.3.10. Update OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 7, 2026Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticatCVE-2026-5703 · Other software · Satel Iberia · reported by cve-coordination@incibe.esHigh 7.1
Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL to include a path traversal payload. Successful exploitation of this vulnerability could allow an attacker to access critical system files containing confidential information.
Product
SenNet Datalogger Serie 200
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Oct 7, 2026This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.CVE-2026-58069 · Other software · Veeam · reported by support@hackerone.comHigh 8.3
This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 7, 2026This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.CVE-2026-58068 · Other software · Veeam · reported by support@hackerone.comMedium 6.8
This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.
Product
Agent for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 7, 2026ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without fCVE-2026-19186 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 8.1
ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without first checking that the received frame is at least ll_hdr_len + authtag_len bytes long. All three variables are uint8_t, so a frame whose payload is shorter than the configured authentication tag makes the subtraction wrap around to a large value (up to 255). The wrapped length is passed unchanged to ieee802154_decrypt_auth() and on to the CCM operation as cipher_pkt.in_len/out_buf_max, with apkt->tag pointing at frame + ll_hdr_len + payload_len. Because the receive buffer is allocated to the exact length of the frame received from the radio driver, the crypto layer then reads several hundred bytes past the end of the packet buffer and writes the same number of decrypted bytes back over it in place. The frame's authentication tag is only verified after this processing has taken place, so no key material, association or prior authentication is needed — a single crafted short frame from any device in radio range is sufficient. Frame validation in ieee802154_validate_frame() does not prevent it: a data frame is accepted with a
Product
zephyr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 7, 2026The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte CVE-2026-15894 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 8.8
The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In sol_pdu_decrypt(), out is allocated as NET_BUF_SIMPLE(17) and then filled with net_buf_simple_add_mem(out, in->data, in->len); net_buf_simple_add() guards its tailroom only with __ASSERT_NO_MSG, which is compiled out in production builds, so when in->len > 17 the underlying memcpy writes attacker-controlled bytes past the 17-byte stack buffer. The copy occurs before any decryption or authentication, so no key material is required to trigger it. The oversized length arises because the mesh scan callback in subsys/bluetooth/mesh/adv.c calls net_buf_simple_restore() before dispatching to bt_mesh_sol_recv(), leaving buf->len covering the entire remaining advertising payload rather than just the Solicitation Service Data. After the parser locates the Service Data AD and consumes the Identification Type byte, the remaining buf->len is the 17-octet Network PDU plus any trailing advertising bytes, and prior to this fix there was no maximum-length check (only a minimum). An attacke
Product
zephyr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 7, 2026This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality.CVE-2026-107104 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code, manipulate application data or perform other unintended actions on the targeted system.
Product
Multi-tenant ERP System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Oct 7, 2026This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint.CVE-2026-107103 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.
Product
Multi-tenant ERP System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Oct 7, 2026This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint.CVE-2026-107102 · Other software · Manacle Technologies · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.
Product
Multi-tenant ERP System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-in.org.in
Oct 7, 2026Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cachCVE-2026-103416 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it.
Product
Eclipse ThreadX - NetX Duo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com gitlab.eclipse.org
Oct 7, 2026Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPassCVE-2026-102782 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ordasoft.com
Oct 7, 2026Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s CVE-2026-102781 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired through Joomla’s core com_ajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser(), authorise(), or a CSRF token check exists anywhere in the handler. Two confirmed impact paths: an unauthenticated GET deletes any slider image by guessable sequential IDs, and an unauthenticated multipart upload with a zip file renames and replaces the entire #__os_touch_slider/#__os_touch_slider_text tables site-wide with attacker-supplied content, with no task parameter even required for the second path.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ordasoft.com
Oct 7, 2026This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.CVE-2025-64393 · Other software · Veeam · reported by support@hackerone.comCritical 9.4
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
Product
Backup and Replication
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 7, 2026This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.CVE-2025-64392 · Other software · Veeam · reported by support@hackerone.comMedium 4.8
This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.
Product
Backup Enterprise Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 7, 2026This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administCVE-2025-64391 · Other software · Veeam · reported by support@hackerone.comMedium 4.1
This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.
Product
Agent for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record veeam.com
Oct 7, 2026A flaw was found in the SMTP email configuration handling of the keycloak-services component.CVE-2026-107121 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic can exploit this to capture sensitive email credentials and message content in plain text.
Product
Red Hat build of Keycloak 26.6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Oct 7, 2026PowerPress Podcasting plugin by Blubrry: Does not validate the destination of redirectsCVE-2026-97354 · WordPress plugins & themes · reported by WPScanMedium 4.1
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.17.11
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.17.11 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026User Private Files: Does not validate that a supplied user belongs to the document being operated on before returning that user's email addressCVE-2026-97331 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.
Product
User Private Files
Fixed in
2.1.9
What to do
Update User Private Files to 2.1.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026String locator: Does not restrict the classes allowedCVE-2026-97188 · WordPress plugins & themes · reported by WPScanHigh 8.8
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.
Product
String locator
Fixed in
2.6.8
What to do
Update String locator to 2.6.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Optimole: Does not perform a capability check before exposing its stored image-optimization account data in a dashboard widgetCVE-2026-96530 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
Product
Optimole
Fixed in
4.2.15
What to do
Update Optimole to 4.2.15 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026If-So Dynamic Content: Does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin pageCVE-2026-87971 · WordPress plugins & themes · reported by WPScanHigh 7.1
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.
Product
If-So Dynamic Content
Fixed in
1.10.2
What to do
Update If-So Dynamic Content to 1.10.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Koinonia Link: Does not check that a user is allowed to change roles before saving a role selection submitted with a profile updateCVE-2026-87782 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
Product
Koinonia Link
Fixed in
1.1.5
What to do
Update Koinonia Link to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026MetForm: Does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notificationsCVE-2026-86833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
Product
MetForm
Fixed in
4.3.1
What to do
Update MetForm to 4.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026WPCafe: Does not restrict access to some of its REST API endpointsCVE-2026-86816 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.
Product
WPCafe
Fixed in
3.0.21
What to do
Update WPCafe to 3.0.21 or newer.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Nexi XPay Build: Does not correctly validate the security token on its payment notification routeCVE-2026-82212 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.
Product
Nexi XPay Build
Affected
up to 7.6.2
What to do
Affects up to 7.6.2. Update Nexi XPay Build to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 7, 2026Nexi XPay Build: Does not verify the payment result supplied to several of its unauthenticated routesCVE-2026-82211 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
Product
Nexi XPay Build
Affected
up to 7.6.2
What to do
Affects up to 7.6.2. Update Nexi XPay Build to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.