Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
391,310 results · page 195 of 7827
Oct 14, 2026Tickera: Does not correctly verify the integrity of incoming payment notificationsCVE-2026-88998 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.
- Product
- Tickera
- Fixed in
- 3.6.0.4
- What to do
- Update Tickera to 3.6.0.4 or newer.
Oct 14, 2026A flaw was found in BusyBox dpkg.CVE-2026-88842 · Other software · Red Hat · reported by Red HatLow 3.3
A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026WPForms Lite: Does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gatewayCVE-2026-82844 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.
- Product
- WPForms Lite
- Fixed in
- 2.0.2.2
- What to do
- Update WPForms Lite to 2.0.2.2 or newer.
Oct 14, 2026A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.CVE-2026-73796 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.4
A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.
- Product
- HPE NonStop TSQLEXE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service.CVE-2026-73795 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.4
A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service.
- Product
- HPE NonStop TMF Auditread2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts.CVE-2026-108072 · Other software · TSplus · reported by cve-coordination@incibe.esMedium 5.4
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server could modify these files to execute arbitrary commands within another user’s security context when that user logs in using the same theme or operating mode. Depending on the affected user’s privileges, exploitation could allow lateral movement between users or privilege escalation.
- Product
- TSplus Remote Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism.CVE-2026-108071 · Other software · TSplus · reported by cve-coordination@incibe.esHigh 8.7
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
- Product
- TSplus Remote Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resouCVE-2026-108070 · Other software · TSplus · reported by cve-coordination@incibe.esHigh 8.7
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal resources.
- Product
- TSplus Remote Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026JetFormBuilder: Missing AuthorizationCVE-2026-107431 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.
- Product
- JetFormBuilder
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Modern Events Calendar Lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-105067 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
- Product
- Modern Events Calendar Lite
- Fixed in
- 7.37.0
- What to do
- Update Modern Events Calendar Lite to 7.37.0 or newer.
Oct 14, 2026The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting.CVE-2026-104795 · Other software · Red Hat · reported by Red HatHigh 8.8
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. **fork()s** a child process 2. **setns()** into the target container's PID and mount namespaces 3. **fchdir()** back to an orphaned FD pointing at the extractor's own root filesystem (where `/crio.sock` is hostPath-mounted) 4. Calls **only `seteuid(target_uid)`** — changing the effective UID but leaving the **real UID and saved-set-UID at 0** and **retaining the permitted capability set** 5. The `check_no_privileged_perms()` guard inspects only the Effective capability set (so it passes), and is **skipped entirely when the target runs as uid 0** 6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with `process.command_line[0]` — the target's argv[0], read from `/proc/<pid>/cmdline` and **fully controlled by the workload** 7. `fpr_kind_executable` calls `exec.Command(executable, "--version").Output()` — executing the **workload's own binary** inside the workload's mount namespace while **ruid=0 in the host user namespace** The executed process can call `setu
- Product
- Red Hat OpenShift Container Platform 4.19
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Oct 14, 2026The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether theCVE-2026-103905 · Other software · JTL-Software GmbH · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.7
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many installations.
- Product
- JTL-Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent iteCVE-2026-103904 · Other software · JTL-Software GmbH · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.6
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.
- Product
- JTL-Shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Email Template Customizer for WooCommerce: Improper Control of Generation of Code ('Code Injection')CVE-2026-103358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.
- Product
- Email Template Customizer for WooCommerce
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Email Template Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Visma Pay for WooCommerce: Does not verify the authenticity of payment gateway return requestsCVE-2026-103308 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.
- Product
- Visma Pay for WooCommerce
- Fixed in
- 1.2.2
- What to do
- Update Visma Pay for WooCommerce to 1.2.2 or newer.
Oct 14, 2026Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sizedCVE-2026-101341 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 1CVE-2026-101339 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 deCVE-2026-101338 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes.CVE-2026-101337 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 8.7
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).
- Product
- NSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WPCode: Does not correctly verify that a request is genuinely for the login screen before entering its snippet safe modeCVE-2026-101301 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
- Product
- WPCode
- Fixed in
- 2.4.0
- What to do
- Update WPCode to 2.4.0 or newer.
Oct 14, 2026A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers).CVE-2026-100229 · Other software · Red Hat · reported by Red HatMedium 6.5
A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in BusyBox's dpkg-deb archive extraction.CVE-2026-90954 · Other software · Red Hat · reported by Red HatHigh 7.8
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in BusyBox httpd's reverse proxy feature.CVE-2026-88829 · Other software · Red Hat · reported by Red HatHigh 7.2
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in gst-plugins-base.CVE-2026-86476 · Other software · Red Hat · reported by Red HatHigh 8.4
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG)CVE-2026-73794 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.6
HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG)
- Product
- HPE NonStop MODULAR NSJ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.CVE-2026-73793 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 7.9
HPE NonStop Middleware software has secret key handling and data deserialization vulnerability.
- Product
- HPE NonStop Middleware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.CVE-2026-73792 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comLow 3.8
A security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow.
- Product
- HPE NonStop Java JToolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.CVE-2026-73791 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comLow 2
A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
- Product
- HPE NonStop Hpjmeter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A flaw was found in the clevis PKCS#11 pin.CVE-2026-109971 · Other software · Red Hat · reported by Red HatMedium 4.7
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in the clevis PKCS#11 pin.CVE-2026-109970 · Other software · Red Hat · reported by Red HatMedium 4.7
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in the clevis PKCS#11 pin.CVE-2026-109969 · Other software · Red Hat · reported by Red HatMedium 4.7
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux).CVE-2026-100231 · Other software · Red Hat · reported by Red HatMedium 6.1
A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion is written into the undersized buffer. An attacker could exploit this by providing media with crafted metadata tags to an application that transcodes or remuxes to ASF format while preserving metadata, potentially causing a denial of service or limited memory corruption.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 14, 2026A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.CVE-2026-73790 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.2
A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.
- Product
- HPE NonStop iTP WebServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable informatioCVE-2026-14851 · Other software · Copart · reported by cve-coordination@incibe.esCritical 9.2
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint responsible for serving PDF invoice files. Furthermore, some URLs for invoicing documents appear to be publicly accessible via search engines, exposing paths to confidential files. Successful exploitation of this vulnerability could allow an attacker to access data to which they should not have access, as well as to predict identifiers in order to access even more confidential information.
- Product
- Copart’s online billing service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Paid Videochat Turnkey Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-107428 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
- Product
- Paid Videochat Turnkey Site
- Affected
- up to 7.5.12
- What to do
- Affects up to 7.5.12. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin".CVE-2026-103671 · Other software · EC-CUBE CO.,LTD. · reported by vultures@jpcert.or.jpMedium 5.3
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.
- Product
- AmazonPay V2 Plugin (4.0/4.1 series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after freeCVE-2026-92392 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9High 8.1
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Local File InclusionCVE-2026-110284 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included.
- Product
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- Affected
- up to 10.3.1
- What to do
- Affects up to 10.3.1. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Restricted Site Access: Missing AuthorizationCVE-2026-110227 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.
- Product
- Restricted Site Access
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Restricted Site Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026CP Multi View Event Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-109901 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.
- Product
- CP Multi View Event Calendar
- Affected
- up to 1.4.41
- What to do
- Affects up to 1.4.41. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2026Gallery Custom Links: Stored Cross-Site ScriptingCVE-2026-107757 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires two coordinated inputs from the same authenticated attacker: an HTML comment payload stored in a comment body (preserved verbatim by WordPress comment kses) and a matching simple_html_dom noise key placed in the attacker's display_name (which survives esc_attr() intact), with substitution occurring after both filters have run during the plugin's default-on output-buffering pass over the full rendered page.
- Product
- Gallery Custom Links
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Gallery Custom Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Meow Lightbox: Stored Cross-Site ScriptingCVE-2026-107756 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the plugin's Output Buffering option is enabled (disabled by default), and requires the attacker to have at least one previously approved comment on the site so that subsequent comments are auto-approved by WordPress core.
- Product
- Meow Lightbox
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update Meow Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-107754 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images (file_info[2] = title)' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Affected
- up to 2.8.190
- What to do
- Affects up to 2.8.190. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 14, 2026Mang Board: Stored Cross-Site ScriptingCVE-2026-107751 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.
- Product
- Mang Board
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Mang Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2026-107650 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Affected
- up to 2.8.190
- What to do
- Affects up to 2.8.190. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 14, 2026Record of Consent Extension for Complianz: Stored Cross-Site ScriptingCVE-2026-107631 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.
- Product
- Record of Consent Extension for Complianz
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Record of Consent Extension for Complianz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.CVE-2026-107171 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 6.9
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.
- Product
- Trellix Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Koha is vulnerable to SQL injection in the Most-circulated items report.CVE-2026-105107 · Other software · Koha Community · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.2
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an allow-list, so it is inserted verbatim into identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY, and the main calculation query). Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments. Limit is appended raw to a LIMIT clause. An authenticated staff user with the reports module permission (not requiring superlibrarian) can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (userid and bcrypt password hashes, two-factor secrets, personal data), api_keys, and sessions. The issue is fixed in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03, and in the 26.11 development branch. This is the unpatched twin of reports/bor_issues_top.pl (CVE-2026-70372).
- Product
- Koha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.koha-community.orgdownload.koha-community.org
Oct 14, 2026Koha is vulnerable to OS command injection in the Task Scheduler deletion path.CVE-2026-105106 · Other software · Koha Community · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.8
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
- Product
- Koha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.koha-community.orgdownload.koha-community.org
Oct 14, 2026Mang Board: Local File InclusionCVE-2026-104909 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.
- Product
- Mang Board
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Mang Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.