Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,546 results · page 4 of 211
Oct 13, 2026Affected systems do not properly restrict access to internal APIs and paths for authenticated users.CVE-2026-44415 · Other software · Siemens · reported by productcert@siemens.comHigh 8.9
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.
- Product
- Industrial Edge Device Kit - arm64 V1.10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Oct 13, 2026WP Testimonials: Does not properly escape testimonial content and reverses WordPress's HTML sanitizationCVE-2026-89269 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
- Product
- WP Testimonials
- Affected
- up to 1.4.13
- What to do
- Affects up to 1.4.13. Update WP Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 12, 2026SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component.CVE-2026-58249 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.5
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
- Product
- SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properlCVE-2026-109673 · Other software · frappe · reported by VulnCheckHigh 8.5
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.
- Product
- erpnext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 12, 2026ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived daCVE-2026-109266 · Other software · ImageMagick · reported by VulnCheckMedium 6.9
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions.CVE-2026-103528 · Other software · Thelia · reported by cret@cert.orgMedium 5.4
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑CVE-2026-103527 · Other software · Thelia · reported by cret@cert.orgMedium 6.1
Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same vCVE-2026-103521 · Other software · Thelia · reported by cret@cert.orgHigh 7.2
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.
- Product
- Thelia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowinCVE-2026-105081 · Other software · ImageMagick · reported by VulnCheckLow 2
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 11, 2026Subscribe to Comments: Does not properly validate a parameter before reflecting it into a link targetCVE-2026-91829 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.
- Product
- Subscribe to Comments
- Fixed in
- 2.3.3
- What to do
- Update Subscribe to Comments to 2.3.3 or newer.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89305 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026paymendo: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89304 · WordPress plugins & themes · reported by WPScanMedium 6.5
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.
- Product
- paymendo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update paymendo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Post Voting System: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89302 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Post Voting System
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Post Voting System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WP Verify API: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89299 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- WP Verify API
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Verify API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Loja Automática: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89297 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Loja Automática
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Loja Automática to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026WpCues Basic Quiz: Does not properly sanitise and escape values before using them in a SQL statementCVE-2026-89214 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
- Product
- WpCues Basic Quiz
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update WpCues Basic Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Llavero.io: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-89213 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
- Product
- Llavero.io
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update Llavero.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Site Setup Wizard: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-89195 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.
- Product
- Site Setup Wizard
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Site Setup Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Topcontent: Does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted contentCVE-2026-88903 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.
- Product
- Topcontent
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Topcontent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Post Snippets: Does not properly escape variable values substituted into snippets before outputting themCVE-2026-12980 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- Post Snippets
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2026Mobile builder: Does not properly restrictCVE-2026-103694 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.
- Product
- Mobile builder
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2026ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list.CVE-2026-107794 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgrt.cpan.org
Oct 10, 2026ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.CVE-2026-107373 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 10, 2026ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list.CVE-2013-10076 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Oct 10, 2026Rank Math SEO: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-104753 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.
- Product
- Rank Math SEO
- Fixed in
- 1.0.280
- What to do
- Update Rank Math SEO to 1.0.280 or newer.
Oct 9, 2026Super Payments: Does not properly verify the authenticity of incoming payment webhook notificationsCVE-2026-103329 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.
- Product
- Super Payments
- Fixed in
- 1.43.1
- What to do
- Update Super Payments to 1.43.1 or newer.
Oct 8, 2026When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.CVE-2026-94448 · Other software · Go standard library · reported by security@golang.orgMedium 6.1
When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.
- Product
- html/template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to rCVE-2026-94439 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation.CVE-2026-85486 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026BackWPup: Does not properly restrict the destination path of files extracted during a backup restoreCVE-2026-86828 · WordPress plugins & themes · reported by WPScanMedium 6.6
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Oct 8, 2026BackWPup: Does not properly restrict web access to the working directory it uses during backup restoresCVE-2026-86826 · WordPress plugins & themes · reported by WPScanMedium 5.9
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
- Product
- BackWPup
- Fixed in
- 5.7.7
- What to do
- Update BackWPup to 5.7.7 or newer.
Oct 8, 2026Image Photo Gallery Final Tiles Grid: Does not properly verify authorization on several of its gallery and image management actionsCVE-2026-104645 · WordPress plugins & themes · reported by WPScanLow 2.7
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.6.14
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.6.14 or newer.
Oct 8, 2026GPTranslate: Does not properly restrict who can store translationsCVE-2026-103309 · WordPress plugins & themes · reported by WPScanHigh 7.5
The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.
- Product
- GPTranslate
- Fixed in
- 2.34.14
- What to do
- Update GPTranslate to 2.34.14 or newer.
Oct 8, 2026A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by idenCVE-2026-107445 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository information belonging to another organization. The same unscoped lookup is used by the mirror action, which may allow creating a repository in a product the user can edit that is configured with another organization's flatpak remote URL and stored remote credentials.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 8, 2026A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta taCVE-2026-107444 · Other software · Red Hat · reported by Red HatMedium 4.3
A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retrieve repository metadata associated with Docker tags belonging to another organization by supplying the tag identifier. This can result in unauthorized disclosure of repository configuration information across organization boundaries.
- Product
- Red Hat Hardened Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 7, 2026The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website vCVE-2026-92862 · Other software · Wavedash Co., Ltd. · reported by vultures@jpcert.or.jpMedium 4.6
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.
- Product
- Ticket Ryutsu Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data.CVE-2025-70519 · Other software · reported by MITREMedium 6.1
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.fanvil.comdarkpoint.ca
Oct 7, 2026The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data.CVE-2025-70515 · Other software · reported by MITREMedium 6.1
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.fanvil.comdarkpoint.ca
Oct 7, 2026A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or CVE-2026-96408 · Other software · Six Apart Ltd. · reported by vultures@jpcert.or.jpCritical 9.3
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
- Product
- Movable Type Cloud Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026MPG: Does not properly validate the structure of imported project data before using it in a database queryCVE-2026-104953 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
- Product
- MPG
- Fixed in
- 4.2.3
- What to do
- Update MPG to 4.2.3 or newer.
Oct 6, 2026Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).CVE-2026-102412 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersonation of trusted Fleet infrastructure components in deployments where those keys are actively used.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).CVE-2026-102410 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLCVE-2026-102407 · Other software · Elastic · reported by security@elastic.coMedium 5.4
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to.
- Product
- Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.CVE-2026-104380 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Oct 5, 2026Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properlCVE-2026-102428 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content.CVE-2026-59787 · Other software · Zabbix · reported by security@zabbix.comMedium 5.3
The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.CVE-2026-19954 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.4
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa". The Net::Whois::Raw library modules are not affected.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.CVE-2019-25777 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.3
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.CVE-2017-20285 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026User Private Files: Does not properly protect its stored private files on multisite installationsCVE-2026-97332 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.
- Product
- User Private Files
- Fixed in
- 2.2.0
- What to do
- Update User Private Files to 2.2.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.