Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
394,398 results · page 380 of 7888
Oct 5, 2026Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local().CVE-2026-88392 · Other software · reported by MITREHigh 7.5
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console CVE-2026-88391 · Other software · reported by MITRECritical 9.8
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary system commands via CREATE ALIAS (pre-auth RCE).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.CVE-2026-79820 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9
A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.
- Product
- HPE Integrated Lights-Out (iLO) 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Kit (formerly ConvertKit) for WooCommerce: Missing AuthorizationCVE-2026-105421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0.
- Product
- Kit (formerly ConvertKit) for WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Kit (formerly ConvertKit) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attackeCVE-2026-92931 · Other software · Progress Software · reported by security@progress.comHigh 8.8
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.
- Product
- @progress/sitefinity-nextjs-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.com
Oct 5, 2026In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by theCVE-2026-77805 · Other software · Progress Software · reported by security@progress.comHigh 7.9
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.
- Product
- Progress® Telerik® Fiddler® Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the instalCVE-2026-77804 · Other software · Progress Software · reported by security@progress.comMedium 6.6
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary file in a user-writable location and then launches the external TrustCert helper application, which elevates and imports the certificate from that file. A local threat actor with low privileges who replaces the temporary file between the time it is written and the time the elevated helper reads it can cause an attacker-supplied root certificate to be installed in the Local Computer Trusted Root Certification Authorities store, enabling subsequent interception and modification of TLS-protected traffic on the machine. Successful exploitation requires the user to initiate the certificate trust operation and approve the elevation prompt.
- Product
- Progress® Telerik® Fiddler® Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forCVE-2026-77803 · Other software · Progress Software · reported by security@progress.comLow 3.6
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.
- Product
- Progress® Telerik® Fiddler® Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding compoCVE-2026-77802 · Other software · Progress Software · reported by security@progress.comMedium 6.3
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while Fiddler frames the request body using only the first Content-Length value. A local threat actor with low privileges who is able to send requests through the same Fiddler proxy instance as another user can exploit this desynchronization against a non-RFC-9110-compliant origin server that keeps the connection alive to smuggle an additional request. Because Fiddler returns the server connection to its pipe pool after reading only the first response, the unread smuggled response remains buffered on the socket and is served to the next session that reuses that connection, allowing the attacker to poison responses delivered to other users and to obtain responses intended for them.
- Product
- Progress® Telerik® Fiddler® Classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability has been found in django-haystack up to 3.3.0.CVE-2026-105315 · Other software · reported by VulDBLow 2
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.CVE-2026-63277 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 8.5
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server oCVE-2026-63270 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 6.7
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL. XForms instance data and the Calc csv and sql data providers still reached the expansion. In fixed versions these places refuse URLs with internal schemes when the URL comes from the document.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer.CVE-2026-63269 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 6.7
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.CVE-2026-63268 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 6.7
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document.CVE-2026-63267 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 6.7
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.CVE-2026-63266 · Other software · The Document Foundation · reported by security@documentfoundation.orgMedium 6.8
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or create files only inside its own private directory.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Polylang: Missing AuthorizationCVE-2026-39783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
- Product
- Polylang
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update Polylang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spCVE-2026-105396 · Other software · heymrun · reported by VulnCheckMedium 5.3
Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to attacker domains, capturing capability tokens to submit decisions executed with owner credentials.
- Product
- heym
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 5, 2026A vulnerability was detected in Casdoor up to 3.161.1.CVE-2026-105307 · Other software · reported by VulDBMedium 5.5
A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026WP Event Solution: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-105073 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- WP Event Solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Event Solution: Missing AuthorizationCVE-2026-103684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
- Product
- WP Event Solution
- Affected
- up to 4.1.25
- What to do
- Affects up to 4.1.25. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Fluent Forms Pro Add On Pack: Missing AuthorizationCVE-2026-94669 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.
- Product
- Fluent Forms Pro Add On Pack
- Affected
- up to 6.2.13
- What to do
- Affects up to 6.2.13. Update Fluent Forms Pro Add On Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in CVE-2026-59788 · Other software · Zabbix · reported by security@zabbix.comMedium 5.7
The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content.CVE-2026-59787 · Other software · Zabbix · reported by security@zabbix.comMedium 5.3
The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication.CVE-2026-59786 · Other software · Zabbix · reported by security@zabbix.comMedium 6.9
Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials.CVE-2026-59785 · Other software · Zabbix · reported by security@zabbix.comMedium 5.1
Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability.CVE-2026-59783 · Other software · Zabbix · reported by security@zabbix.comLow 2.3
The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability. This only affects deployments where MySQL/MariaDB database is used as the Zabbix database.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulCVE-2026-59782 · Other software · Zabbix · reported by security@zabbix.comMedium 6.9
The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026WP Dummy Content Generator: Missing AuthorizationCVE-2026-39763 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0.
- Product
- WP Dummy Content Generator
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0.CVE-2026-105291 · Other software · feelec-yishu · reported by VulDBLow 2.1
A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- feelcrm-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0.CVE-2026-105290 · Other software · feelec-yishu · reported by VulDBMedium 5.5
A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- feelcrm-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was found in feelec-yishu feelcrm-os 1.0.0.CVE-2026-105289 · Other software · feelec-yishu · reported by VulDBLow 2
A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer_form[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- feelcrm-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value.CVE-2026-19395 · Other software · qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Medium 6.6
In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error handler halts the device.
- Product
- Qt for MCUs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0.CVE-2026-105288 · Other software · feelec-yishu · reported by VulDBLow 2.1
A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- feelcrm-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A flaw has been found in feelec-yishu feelcrm-os 1.0.0.CVE-2026-105287 · Other software · feelec-yishu · reported by VulDBLow 2.1
A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups[] causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- feelcrm-os
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455.CVE-2026-105286 · Other software · Totolink · reported by VulDBLow 2.1
A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit is now public and may be used.
- Product
- A3002MU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 5, 2026A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455.CVE-2026-105285 · Other software · Totolink · reported by VulDBCritical 9.3
A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_name leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
- Product
- A3002MU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 5, 2026CURCY: Incorrect CalculationCVE-2026-97071 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17.
- Product
- CURCY
- Affected
- up to 2.2.17
- What to do
- Affects up to 2.2.17. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Starter Templates: Missing AuthorizationCVE-2026-39721 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a through 4.7.7.
- Product
- Starter Templates
- Affected
- up to 4.7.7
- What to do
- Affects up to 4.7.7. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targetCVE-2026-19185 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 7.8
The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the per-target data buffers those array elements point at. Each struct i3c_ccc_target_payload carries its own data pointer and data_len, and neither was passed through K_SYSCALL_MEMORY() before the payload was handed to z_impl_i3c_do_ccc() and on to the controller driver. The verifier also operated on the caller's live structure rather than a snapshot, so validated fields could be changed by a second user thread between the check and the driver's use — unlike the sibling z_vrfy_i3c_transfer(), which has always copied its message array first. The defect is only present in CONFIG_USERSPACE builds, where drivers/i3c/i3c_handlers.c is compiled. An unprivileged user-mode thread that has been granted access to the I3C controller device object — the ordinary way an application lets a user thread talk to I3C peripherals — can issue a direct CCC whose target payload data pointer names an arbitrary kernel address. Controller drivers dereference that pointer directly (for example drivers/i3c/i3
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of CVE-2026-19184 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgHigh 8.4
The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data->results_length and used it in mcux_gau_adc_read_samples() as the number of uint16_t slots available. Because each conversion result occupies sizeof(uint16_t) bytes, a buffer that was accepted as "large enough" could be written with up to twice its size in bytes, so every sample past the buffer's midpoint was written out of bounds. adc_read() and adc_read_async() are Zephyr system calls. The syscall verifier in drivers/adc/adc_handlers.c only confirms that the caller owns buffer_size writable bytes (K_SYSCALL_MEMORY_WRITE); deciding whether that size is sufficient for the requested channels and extra_samplings is delegated entirely to the driver. On a build with CONFIG_USERSPACE=y, a user-mode thread that has been granted the ADC device object could therefore submit a deliberately half-sized buffer and cause the driver's work-queue handler — which runs in supervisor mode, outside the caller's MPU restrictions — to write ADC conversion
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455.CVE-2026-105284 · Other software · Totolink · reported by VulDBCritical 9.3
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- A3002MU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Oct 5, 2026A security flaw has been discovered in Shaarli up to 0.16.3.CVE-2026-105263 · Other software · reported by VulDBMedium 5.1
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. Upgrading to version 0.16.4 is sufficient to fix this issue. The patch is named 8ca4de8e7c932a684481f5fbb1229fe16de1f4d2. It is advisable to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was detected in vgmstream up to r2117.CVE-2026-105251 · Other software · reported by VulDBMedium 5.3
A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding/psx_decoder.c of the component VAG File Handler. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. The patch is named 4b8316652a30d40f99ad43310bed273fd1f8a7a3. It is suggested to install a patch to address this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026QR Redirector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105069 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.
- Product
- QR Redirector
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update QR Redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Events Manager: Insertion of Sensitive Information Into Sent DataCVE-2026-105068 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.
- Product
- Events Manager
- Affected
- up to 7.4.5
- What to do
- Affects up to 7.4.5. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')CVE-2026-105064 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.22.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026WP Admin Audit: Missing AuthorizationCVE-2026-105062 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17.
- Product
- WP Admin Audit
- Affected
- up to 1.2.17
- What to do
- Affects up to 1.2.17. Update WP Admin Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026Logo Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105060 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through 4.0.4.
- Product
- Logo Showcase
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Logo Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2026eCommerce Product Catalog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105056 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.