Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
393,460 results · page 316 of 7870
Oct 9, 2026The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration.CVE-2026-85479 · Other software · Grid Protection Alliance · reported by ics-cert@hq.dhs.govMedium 6.9
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.
- Product
- openPDC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature.CVE-2026-79363 · Other software · reported by MITREMedium 5.9
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfaydin.blogfaydin.blog
Oct 9, 2026Dashboard Notes: Cross-Site Request Forgery (CSRF)CVE-2026-62026 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3.
- Product
- Dashboard Notes
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Dashboard Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026A flaw was found in libhangul.CVE-2026-108063 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash, resulting in a Denial of Service (DoS).
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comgithub.com
Oct 9, 2026ProcessMaker is an open source workflow management software suite.CVE-2026-107803 · Other software · ProcessMaker · reported by GitHubMedium 6.5
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.
- Product
- processmaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key.CVE-2026-107785 · Other software · Sirius Computer, Inc. · reported by d0a6edd6-4b7d-45f2-a6f9-9b944f7b6132Medium 6.3
Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this size; instead it attempts to use the `wg set` command to update the live tunnel, and write the invalid key to the WireGuard configuration file. The update fails, so the live tunnel keeps using its previous preshared key until the tunnel is shut down. The tunnel will fail to start when restarted. For a peer which has never successfully negotiated a 32-byte bilocation key in a Crux C2 organization which has the "Enforce SKA Use" setting turned off, no preshared key will be set for the tunnel. Therefore, an attacker who is able to intercept and store the peer's traffic, and has access (or will have access) to a cryptographically relevant quantum computer, will be able to decrypt the tunnel.
- Product
- Crux Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package.CVE-2026-106581 · Other software · Docker · reported by security@docker.comHigh 7.3
Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The internal data publisher on openPDC accepts network connections without authentication in its default configuration.CVE-2026-105281 · Other software · Grid Protection Alliance · reported by ics-cert@hq.dhs.govHigh 8.7
The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.
- Product
- openPDC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load.CVE-2026-104629 · Other software · Grid Protection Alliance · reported by ics-cert@hq.dhs.govHigh 7.7
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.
- Product
- openPDC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted.CVE-2026-101022 · Other software · Grid Protection Alliance · reported by ics-cert@hq.dhs.govMedium 5.3
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.
- Product
- openPDC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026A service console interface on openPDC and openHistorian deserializes a client-supplied data structure.CVE-2026-100730 · Other software · Grid Protection Alliance · reported by ics-cert@hq.dhs.govCritical 9.3
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.
- Product
- openPDC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook tCVE-2026-96396 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 4.9
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previeCVE-2026-96395 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Low 3.6
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generaCVE-2026-96394 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Low 2.9
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-oCVE-2026-96393 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Low 3.6
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Werkstatt: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-94062 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.
- Product
- Werkstatt
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update Werkstatt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Whistle - Sports Club: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94061 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle - Sports Club: from n/a through 4.2.
- Product
- Whistle - Sports Club
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Whistle - Sports Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Voldor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94060 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Voldor: from n/a through 1.0.0.
- Product
- Voldor
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Voldor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Ogency: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94059 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.
- Product
- Ogency
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ogency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Treck: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94058 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.
- Product
- Treck
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Treck to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a CVE-2026-8374 · Other software · SwitchBot · reported by a341c0d1-ebf7-493f-a84e-38cf86618674High 8.5
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
- Product
- SwitchBot Lock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc.CVE-2026-86405 · Websites & servers · reported by iletisim@usom.gov.trCritical 9.8
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc.CVE-2026-85531 · Other software · Sipay Electronic Money and Payment Services Inc. · reported by iletisim@usom.gov.trCritical 9.8
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.
- Product
- OpenCart Virtual POS Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026WPFunnels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62029 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.13.3.
- Product
- WPFunnels
- Affected
- up to 3.13.3
- What to do
- Affects up to 3.13.3. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Before After Image Comparison – Image comparison for WP: Missing AuthorizationCVE-2026-62028 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.
- Product
- Before After Image Comparison – Image comparison for WP
- Affected
- up to 1.1.21
- What to do
- Affects up to 1.1.21. Update Before After Image Comparison – Image comparison for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Jetpack: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-106602 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
- Product
- Jetpack
- Affected
- up to 16.2
- What to do
- Affects up to 16.2. Update Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Jetpack: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-106601 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
- Product
- Jetpack
- Affected
- up to 16.2
- What to do
- Affects up to 16.2. Update Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Th Shop Mania: Missing AuthorizationCVE-2026-105883 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.
- Product
- Th Shop Mania
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Th Shop Mania to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026QA Analytics: Insertion of Sensitive Information Into Sent DataCVE-2026-105877 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.
- Product
- QA Analytics
- Affected
- up to 5.3.0.0
- What to do
- Affects up to 5.3.0.0. Update QA Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Product Configurator for WooCommerce: Deserialization of Untrusted DataCVE-2026-105872 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.
- Product
- Product Configurator for WooCommerce
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Product Configurator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026WP Associate Post R2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105870 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.
- Product
- WP Associate Post R2
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update WP Associate Post R2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026AcyMailing SMTP Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105318 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.
- Product
- AcyMailing SMTP Newsletter
- Affected
- up to 11.1.0
- What to do
- Affects up to 11.1.0. Update AcyMailing SMTP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Quiz And Survey Master: Deserialization of Untrusted DataCVE-2026-104392 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- Product
- Quiz And Survey Master
- Affected
- up to 11.2.7
- What to do
- Affects up to 11.2.7. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026its gallery conversion REST endpoint that: Envira Gallery Lite before 1.16.2 contains a missing authorizationCVE-2026-104079 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.
- Product
- its gallery conversion REST endpoint that
- Fixed in
- 1.16.2
- What to do
- Update its gallery conversion REST endpoint that to 1.16.2 or newer.
Full record and what to do →NVD recordlazytitan.rowordpress.org
Oct 9, 2026Improper input validation vulnerability in Apache Camel Karavan.CVE-2026-103413 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, including pods requesting hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation or added capabilities. This issue affects Apache Camel Karavan: from 4.0.0 before 4.22.1. Users are recommended to upgrade to version 4.22.1, which fixes the issue.
- Product
- Apache Camel Karavan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orggithub.com
Oct 9, 2026Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan.CVE-2026-103412 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any location writable by the Karavan process. An authenticated user of any role could use this to overwrite application configuration or files on the application classpath and so execute code in the Karavan container. This issue affects Apache Camel Karavan: from 3.18.0 before 4.22.1. Users are recommended to upgrade to version 4.22.1, which fixes the issue.
- Product
- Apache Camel Karavan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orggithub.com
Oct 9, 2026The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity documeCVE-2026-103220 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Medium 4.5
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity documeCVE-2026-101130 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Low 3.6
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in AffinitCVE-2026-101094 · Other software · canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6Low 3.6
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
- Product
- affinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026Testimonials by BestWebSoft: Does not sanitise and escape a parameter before using it in a SQL queryCVE-2026-89235 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.
- Product
- Testimonials by BestWebSoft
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Testimonials by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Shipping for Nova Poshta: Does not perform any authorisationCVE-2026-87846 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.
- Product
- Shipping for Nova Poshta
- Affected
- up to 1.19.8
- What to do
- Affects up to 1.19.8. Update Shipping for Nova Poshta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Livees Checkout: Does not perform any capabilityCVE-2026-86851 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.
- Product
- Livees Checkout
- Affected
- up to 7.0.2
- What to do
- Affects up to 7.0.2. Update Livees Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026GDPR Data Request Form: Does not have CSRF protectionCVE-2026-85348 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- GDPR Data Request Form
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update GDPR Data Request Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Scripts n Styles: Missing AuthorizationCVE-2026-62042 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8.
- Product
- Scripts n Styles
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update Scripts n Styles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026WP Event Manager: Missing AuthorizationCVE-2026-62041 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1.
- Product
- WP Event Manager
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update WP Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Restrict User Access – Membership Plugin with Force: Missing AuthorizationCVE-2026-62040 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.
- Product
- Restrict User Access – Membership Plugin with Force
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Restrict User Access – Membership Plugin with Force to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Html5 Audio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8.
- Product
- Html5 Audio Player
- Affected
- up to 2.8.8
- What to do
- Affects up to 2.8.8. Update Html5 Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026All Bootstrap Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-62036 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31.
- Product
- All Bootstrap Blocks
- Affected
- up to 1.3.31
- What to do
- Affects up to 1.3.31. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026Asgaros Forum: Missing AuthorizationCVE-2026-39779 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0.
- Product
- Asgaros Forum
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Asgaros Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2026AI Translation for Polylang: Missing AuthorizationCVE-2026-107419 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2.
- Product
- AI Translation for Polylang
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update AI Translation for Polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.