Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
390,525 results · page 165 of 7811
Oct 15, 2026An observable timing discrepancy vulnerability has been reported to affect QuRouter.CVE-2026-24715 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later
- Product
- QuRouter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch.CVE-2026-22896 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.2
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later
- Product
- Network & Virtual Switch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server CVE-2026-19377 · Other software · Cato Networks · reported by 2505284f-8ffb-486c-bf60-e19c1097a90bMedium 6
Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.
- Product
- Cato Client for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledge.catonetworks.com
Oct 15, 2026Elementor Website Builder – more than just a page builder: Sensitive Information ExposureCVE-2026-11905 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full post_content and plaintext post_password of private, draft, pending, and future posts belonging to any author, including Administrators and Editors.
- Product
- Elementor Website Builder – more than just a page builder
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update Elementor Website Builder – more than just a page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.CVE-2026-110934 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 4.4
Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.
- Product
- Vyond
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.CVE-2026-110933 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 4.4
Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7.
- Product
- Vyond
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026User Rights Access Manager: Does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was createdCVE-2026-109145 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
- Product
- User Rights Access Manager
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update User Rights Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Spin Wheel: Does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize couponCVE-2026-106031 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
- Product
- Spin Wheel
- Fixed in
- 2.2.1
- What to do
- Update Spin Wheel to 2.2.1 or newer.
Oct 15, 2026Easy HTTPS Redirection (SSL): Does not perform capability checks in some of its AJAX actionsCVE-2026-104643 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
- Product
- Easy HTTPS Redirection (SSL)
- Fixed in
- 2.0.2
- What to do
- Update Easy HTTPS Redirection (SSL) to 2.0.2 or newer.
Oct 15, 2026Cardinity Payment Gateway for WooCommerce: Does not properly verify the authenticity of the payment notifications it receivesCVE-2026-103324 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed.
- Product
- Cardinity Payment Gateway for WooCommerce
- Fixed in
- 3.4.2
- What to do
- Update Cardinity Payment Gateway for WooCommerce to 3.4.2 or newer.
Oct 15, 2026eaSYNC Booking: Does not perform authorization or nonce checks on several of its cancellation-related AJAX actionsCVE-2026-103304 · WordPress plugins & themes · reported by WPScanMedium 5.3
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
- Product
- eaSYNC Booking
- Fixed in
- 1.3.31
- What to do
- Update eaSYNC Booking to 1.3.31 or newer.
Oct 15, 2026When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate CVE-2026-101308 · Other software · FreeBSD · reported by secteam@freebsd.orgMedium 5.5
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking. An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.CVE-2026-101307 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 8.2
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.CVE-2026-101306 · Other software · FreeBSD · reported by secteam@freebsd.orgCritical 9.8
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.CVE-2026-101305 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 8.8
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum cCVE-2026-101304 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 7.1
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.CVE-2026-101303 · Other software · FreeBSD · reported by secteam@freebsd.orgHigh 7.5
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail network isolation.
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding.CVE-2026-101302 · Other software · FreeBSD · reported by secteam@freebsd.orgMedium 6.5
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter.CVE-2025-68404 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.5
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and later
- Product
- QuRouter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026An external control of system or configuration setting vulnerability has been reported to affect QuRouter.CVE-2025-68403 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.6
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later
- Product
- QuRouter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Video Station.CVE-2025-66275 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A path traversal vulnerability has been reported to affect Video Station.CVE-2025-66272 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
- Product
- Video Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central.CVE-2025-29897 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.3
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-29896 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A NULL pointer dereference vulnerability has been reported to affect Qsync Central.CVE-2025-29895 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2.3
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later
- Product
- Qsync Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Mang Board WP: Stored Cross-Site ScriptingCVE-2026-88043 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mang Board WP
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026The Ocean Extra: Arbitrary shortcode executionCVE-2026-86803 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Ocean Extra
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update The Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026VK Blocks: Stored Cross-Site ScriptingCVE-2026-78087 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- VK Blocks
- Affected
- up to 1.126.1
- What to do
- Affects up to 1.126.1. Update VK Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: Stored Cross-Site ScriptingCVE-2026-78001 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
- Affected
- up to 1.27.13
- What to do
- Affects up to 1.27.13. Update Post and Page Builder by BoldGrid – Visual Drag and Drop Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026Premium Packages – Sell Digital Products Securely: Unauthenticated Stored Cross-Site ScriptingCVE-2026-18586 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Premium Packages – Sell Digital Products Securely
- Affected
- up to 7.0.5
- What to do
- Affects up to 7.0.5. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2026-18557 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Affected
- up to 1.8.42
- What to do
- Affects up to 1.8.42. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Stored Cross-Site ScriptingCVE-2026-18548 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Affected
- up to 4.5.14
- What to do
- Affects up to 4.5.14. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization bypassCVE-2026-17031 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary Media Library attachments.
- Product
- Checkout Field Manager (Checkout Manager) for WooCommerce
- Affected
- up to 7.9.6
- What to do
- Affects up to 7.9.6. Update Checkout Field Manager (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026Import and export users and customers: Stored Cross-Site ScriptingCVE-2026-17001 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Import and export users and customers
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026Tracking Code Manager: Reflected Cross-Site ScriptingCVE-2026-15180 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Tracking Code Manager
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Tracking Code Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2026Link Library: Time-based SQL InjectionCVE-2026-15090 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Link Library
- Affected
- up to 7.9.2
- What to do
- Affects up to 7.9.2. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.CVE-2026-76667 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.7
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
- Product
- HPE NonStop EXPAND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.CVE-2026-76666 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.7
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
- Product
- HPE NonStop EXPAND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.CVE-2026-76665 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.1
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
- Product
- HPE NonStop EXPAND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026PhastPress: Server-Side Request ForgeryCVE-2026-3712 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
- Product
- PhastPress
- Affected
- up to 3.10
- What to do
- Affects up to 3.10. Update PhastPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-14572 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Kirki – Freeform Page Builder, Website Builder & Customizer
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 202610Web Booster – Website speed optimization, Cache & Page Speed optimizer: Arbitrary File UploadCVE-2026-108587 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.
- Product
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
- Affected
- up to 2.34.10
- What to do
- Affects up to 2.34.10. Update 10Web Booster – Website speed optimization, Cache & Page Speed optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement.CVE-2026-93484 · Other software · Znuny · reported by MITREHigh 8.6
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or denial of service. Specifically this is in Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB via the ContentSearch parameter. The parameter is expected to be either "AND" or "OR", but its value was concatenated directly into the generated SQL query without validation.
- Product
- Znuny
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a sCVE-2026-93483 · Other software · Znuny · reported by MITRECritical 9.5
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. This grants full access to confidential data and system controls. More specifically, the HTTPBasicAuth modules for the agent (Kernel::System::Auth::HTTPBasicAuth) and customer (Kernel::System::CustomerAuth::HTTPBasicAuth) interfaces read the username to log in not only from $ENV{REMOTE_USER} (set by the web server after successful authentication), but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header. On systems where HTTPBasicAuth was configured as the authentication backend, this allowed an attacker to log in as any existing user by sending a request with a forged Remote-User header, without providing any credentials.
- Product
- Znuny
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operationsCVE-2026-76664 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.4
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations
- Product
- HPE NonStop EXPAND
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address CVE-2026-110912 · Other software · DragonFlyBSD · reported by MITREHigh 7.1
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.
- Product
- DragonFlyBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the querCVE-2026-110911 · Other software · Wheels · reported by MITRECritical 9.8
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.
- Product
- Wheels
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.CVE-2026-76663 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.5
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
- Product
- HPE NonStop TELSERV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.CVE-2026-76662 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.9
A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
- Product
- HPE NonStop TELSERV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project.CVE-2026-110909 · Other software · Wheels · reported by MITREMedium 5
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.
- Product
- Wheels CLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.