Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
399,200 results · page 469 of 7984
Oct 6, 2026Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.CVE-2026-32578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
- Affected
- up to 1.1.2606090
- What to do
- Affects up to 1.1.2606090. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.CVE-2026-32577 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.CVE-2026-32575 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
- Affected
- up to 11.7.0
- What to do
- Affects up to 11.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Smart Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32574 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.
- Product
- Smart Forms
- Affected
- up to 2.6.104
- What to do
- Affects up to 2.6.104. Update Smart Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.CVE-2026-32572 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
- Affected
- up to 4.2.13
- What to do
- Affects up to 4.2.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.CVE-2026-32571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
- Affected
- up to 3.6.8
- What to do
- Affects up to 3.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.CVE-2026-32570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.CVE-2026-32569 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
- Affected
- up to 6.2.2
- What to do
- Affects up to 6.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.CVE-2026-32568 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
- Affected
- up to 1.9.33
- What to do
- Affects up to 1.9.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026WooCommerce Appointments: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32557 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from n/a through 5.3.2.
- Product
- WooCommerce Appointments
- Affected
- up to 5.3.2
- What to do
- Affects up to 5.3.2. Update WooCommerce Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.CVE-2026-25434 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.CVE-2026-25433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105879 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.
- Product
- JetElements For Elementor
- Affected
- up to 2.9.2.2
- What to do
- Affects up to 2.9.2.2. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.CVE-2026-105317 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.CVE-2026-105071 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.
- Affected
- up to 1.5.17
- What to do
- Affects up to 1.5.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.CVE-2026-105070 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
- Affected
- up to 10.31.7
- What to do
- Affects up to 10.31.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.CVE-2026-105061 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
- Affected
- up to 1.9.0.0
- What to do
- Affects up to 1.9.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Delete All Comments of: Missing AuthorizationCVE-2026-105059 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1.
- Product
- Delete All Comments of
- Affected
- up to 7.1
- What to do
- Affects up to 7.1. Update Delete All Comments of to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.CVE-2026-105058 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.CVE-2026-105057 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.
- Affected
- up to 5.7.11
- What to do
- Affects up to 5.7.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.CVE-2026-104814 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.CVE-2026-104757 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.CVE-2026-104747 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.CVE-2026-104672 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
- Affected
- up to 4.17.0
- What to do
- Affects up to 4.17.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.CVE-2026-104670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
- Affected
- up to 4.4.9
- What to do
- Affects up to 4.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in picu <= 3.10.1 versions.CVE-2026-104406 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
- Affected
- up to 3.10.1
- What to do
- Affects up to 3.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.CVE-2026-104405 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
- Affected
- up to 4.17.0
- What to do
- Affects up to 4.17.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Motors: Insertion of Sensitive Information Into Sent DataCVE-2026-104399 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.
- Product
- Motors
- Affected
- up to 1.4.124
- What to do
- Affects up to 1.4.124. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.CVE-2026-104395 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
- Affected
- up to 3.10.1
- What to do
- Affects up to 3.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.CVE-2026-104394 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
- Affected
- up to 1.8.12.3
- What to do
- Affects up to 1.8.12.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.CVE-2026-104387 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
- Affected
- up to 11.17.9
- What to do
- Affects up to 11.17.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.CVE-2026-104385 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Payflex Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.
- Product
- Payflex Payment Gateway
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Payflex Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Subscriber Broken Access Control in WPO365 <= 44.1 versions.CVE-2026-102915 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
- Affected
- up to 44.1
- What to do
- Affects up to 44.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.CVE-2026-102387 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.CVE-2026-100518 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
- Affected
- up to 5.40
- What to do
- Affects up to 5.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application.CVE-2026-85153 · Other software · Schmooze · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials and cryptographic keys. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to backend and cloud resources and forge client requests on the targeted system.
- Product
- Schmooze dating mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow.CVE-2026-105305 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.
- Product
- Red Hat build of Keycloak 26.6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 6, 2026elegro Crypto Payment: Does not require a shared secret to be configured before trusting incoming payment notification requestsCVE-2026-94299 · WordPress plugins & themes · reported by WPScanMedium 6.5
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.
- Product
- elegro Crypto Payment
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update elegro Crypto Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.CVE-2026-94293 · Other software · Murrelektronik · reported by info@cert.vde.comCritical 9.3
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
- Product
- Software AAS Edge Client all versions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026File Media Renamer: Does not verify that the requesting user is authorised to modify a given media attachmentCVE-2026-94278 · WordPress plugins & themes · reported by WPScanMedium 5.5
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
- Product
- File Media Renamer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update File Media Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Deema Payment Gateway: Does not verify the payment with the payment providerCVE-2026-94271 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.
- Product
- Deema Payment Gateway
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Deema Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Deema Payment Gateway: Does not verify the authenticity of incoming payment provider notificationsCVE-2026-94270 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.
- Product
- Deema Payment Gateway
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Deema Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Fast Courier: Does not restrict an unauthenticated REST route that writes order fulfillment dataCVE-2026-89289 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
- Product
- Fast Courier
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update Fast Courier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Slider Pro: Does not perform any capability or authorisation check on one of its AJAX actionsCVE-2026-86786 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.
- Product
- Slider Pro
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 6, 2026Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to CVE-2026-59358 · Other software · Cloud Foundry · reported by security@vmware.comHigh 7.6
Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret. UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token
- Product
- UAA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenCVE-2026-59357 · Other software · Cloud Foundry · reported by security@vmware.comMedium 6.5
Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting a UAA access token or a cross-client ID token as the callback’s id_token parameter. The issue only manifests when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that zone’s own /oauth/token endpoint (a “self-UAA” OIDC configuration). In this configuration, the callback takes a supplied id_token directly instead of requiring the authorization code exchange, and does not verify that the token was actually issued as an ID token for the specific self-OIDC relying-party client. An attacker holding any valid UAA JWT for themselves — including a plain access token with only uaa.user scope, or a valid ID token issued to an unrelated client such as cf — can present it as the callback’s id_token and be authenticated into a mapped local (“shadow”) account. Because the resulting session is not verified against the originating token’s true audience or user_i
- Product
- UAA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Memory corruption while processing service requests.CVE-2026-57559 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing service requests.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Memory Corruption when executing system service routines due to improper handling of user input buffers.CVE-2026-57555 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when executing system service routines due to improper handling of user input buffers.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.CVE-2026-57554 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.