Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

453new WordPress flaws this week

394,547entries in the database

394,547 results · page 404 of 7891

Oct 1, 2026MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token CVE-2026-103651 · Other software · MISP · reported by 5a6e4751-2f3f-4070-9419-94fb35b644e8High 7.6
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time the password was entered, rather than against the authoritative counter stored in the database. Because the session-cached counter is not updated after a token is successfully consumed, an attacker who holds a valid session (password already submitted) can reuse a previously burned HOTP token. The stale cached counter still matches the replayed token, granting a second successful authentication and effectively rewinding the counter state. Preconditions: - The target user has HOTP (paper token) second-factor authentication enabled. - The attacker possesses a valid session in which the password step has already been completed (the OTP step is pending). - The attacker has access to at least one HOTP token value (e.g., a paper token list). Security impact: - Bypass of the second authentication factor, allowing unauthorized access to a user's MISP account. - Corruption of the HOTP cou
Product
MISP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 1, 2026A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1.CVE-2026-103544 · Other software · datadrivenconstruction · reported by VulDBLow 2.1
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Product
OpenConstructionERP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 1, 2026The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation.CVE-2025-41753 · Other software · WAGO · reported by info@cert.vde.comCritical 9.3
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.
Product
0751-9x01
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record certvde.com
Oct 1, 2026Payments for Hubtel: Does not prevent public access to a debug log inCVE-2026-96255 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.
Product
Payments for Hubtel
Fixed in
1.0.2
What to do
Update Payments for Hubtel to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Payments for Hubtel: Does not verify that payment notifications received by its payment callback come from the payment providerCVE-2026-96200 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.
Product
Payments for Hubtel
Fixed in
1.0.2
What to do
Update Payments for Hubtel to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Payments for Hubtel: Does not verify that the requester is authorized to view an order before redirecting a public payment-callback requestCVE-2026-96173 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.
Product
Payments for Hubtel
Fixed in
1.0.2
What to do
Update Payments for Hubtel to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Five Star Restaurant Reviews: Does not properly escape a user-supplied value before outputting it into an HTML tagCVE-2026-92412 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
Product
Five Star Restaurant Reviews
Fixed in
2.3.14
What to do
Update Five Star Restaurant Reviews to 2.3.14 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026WP Fusion Lite: Does not require authentication on a settings handler that runs during admin initializationCVE-2026-90974 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
Product
WP Fusion Lite
Fixed in
3.48.0
What to do
Update WP Fusion Lite to 3.48.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026WP Fusion Lite: Does not perform a capability check on two of its admin AJAX handlersCVE-2026-90972 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.
Product
WP Fusion Lite
Fixed in
3.48.0
What to do
Update WP Fusion Lite to 3.48.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Pro Like Button: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-89296 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Product
Pro Like Button
Fixed in
2.0
What to do
Update Pro Like Button to 2.0 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Redux Framework: Authorization bypassCVE-2026-88999 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php page.
Product
Redux Framework
Affected
up to 4.5.14
What to do
Affects up to 4.5.14. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 1, 2026If-So Dynamic Content: Does not sanitize a conversion name before storing itCVE-2026-87973 · WordPress plugins & themes · reported by WPScanLow 3.1
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.
Product
If-So Dynamic Content
Fixed in
1.10.2
What to do
Update If-So Dynamic Content to 1.10.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026If-So Dynamic Content: Does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is servedCVE-2026-87970 · WordPress plugins & themes · reported by WPScanMedium 4.7
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
Product
If-So Dynamic Content
Fixed in
1.10.2
What to do
Update If-So Dynamic Content to 1.10.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Download Manager: Does not sufficiently sanitise and escape a package setting before outputting it back in a pageCVE-2026-86610 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected, as the sanitisation applied when the setting is saved does not neutralise single quotes there.
Product
Download Manager
Fixed in
3.3.71
What to do
Update Download Manager to 3.3.71 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Extendify: Stored Cross-Site ScriptingCVE-2026-85679 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route's permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path.
Product
Extendify
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Extendify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Paytm Payment Gateway: Does not properly escape data taken from payment callbacks before using it in a SQL statementCVE-2026-81809 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.
Product
Paytm Payment Gateway
Fixed in
2.8.9
What to do
Update Paytm Payment Gateway to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Paytm Payment Gateway: Does not sanitize and escape data it stores from payment callbacks before outputting it in an admin pageCVE-2026-81739 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.
Product
Paytm Payment Gateway
Fixed in
2.8.9
What to do
Update Paytm Payment Gateway to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not requirCVE-2026-80276 · Other software · Comelit Group S.p.A. · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166High 7.5
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the Remote Configuration Password - can be read in cleartext by a remote, unauthenticated attacker.
Product
1456B Multi-User Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record accesscontrol.fail pro.comelitgroup.com
Oct 1, 2026Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative passwoCVE-2026-80275 · Other software · Comelit Group S.p.A. · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166High 8.8
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password.
Product
1456B Multi-User Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record accesscontrol.fail pro.comelitgroup.com
Oct 1, 2026HCL Digital Experience is affected by improper input sanitation.CVE-2026-67075 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.5
HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this.
Product
Digital Experience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Oct 1, 2026Cache Enabler: Does not validate a URL before using it to build a filesystem path in its cache purge routineCVE-2026-19253 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or passes a request-derived URL to its public cache-clearing hook.
Product
Cache Enabler
Fixed in
1.8.17
What to do
Update Cache Enabler to 1.8.17 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026A flaw has been found in formtools.org Form Tools up to 3.1.1.CVE-2026-103542 · Other software · formtools.org · reported by VulDBLow 2.1
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Product
Form Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 1, 2026A vulnerability was detected in formtools.org Form Tools up to 3.1.1.CVE-2026-103541 · Other software · formtools.org · reported by VulDBLow 2.1
A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Product
Form Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 1, 2026A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1.CVE-2026-103540 · Other software · formtools.org · reported by VulDBLow 2.1
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Product
Form Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 1, 2026BackupSheep WordPress Backup: Does not properly validate its integration keyCVE-2026-101148 · WordPress plugins & themes · reported by WPScanCritical 10
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover. The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.
Product
BackupSheep WordPress Backup
Affected
up to 1.8
What to do
Affects up to 1.8. Update BackupSheep WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium: Do not correctly enforce the REST API nonceCVE-2026-101147 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.
Product
Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium
Fixed in
6.0.8
What to do
Update Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium to 6.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 1, 2026The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Arbitrary shortcode executionCVE-2026-92966 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream, where WordPress core's do_shortcode filter at priority 11 re-parses and executes it.
Product
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for
Affected
up to 5.7.0
What to do
Affects up to 5.7.0. Update The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026WP Popular Posts: Sensitive Information ExposureCVE-2026-92548 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body, password, meta, status, and guid — from non-public post objects such as wp_block synced patterns that WordPress core itself refuses to expose to unauthenticated callers. This is possible because the plugin's REST route is registered with a permission_callback of __return_true and passes the caller-supplied context parameter (e.g., context=edit) directly to WP_REST_Posts_Controller::prepare_item_for_response() without invoking get_item_permissions_check() or check_read_permission(), while the underlying query accepts an arbitrary post_type value without enforcing public or show_in_rest visibility flags.
Product
WP Popular Posts
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update WP Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by expCVE-2026-82829 · Other software · Hitachi Industrial Equipment Systems · reported by hirt@hitachi.co.jpCritical 9.3
Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite: through 3.3.0.
Product
Hitachi Coding Software Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi-ies.com
Oct 1, 2026Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations.CVE-2026-82828 · Other software · Hitachi Industrial Equipment Systems · reported by hirt@hitachi.co.jpHigh 8.7
Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0.
Product
Hitachi Coding Software Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi-ies.com
Oct 1, 2026Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key.CVE-2026-82827 · Other software · Hitachi Industrial Equipment Systems · reported by hirt@hitachi.co.jpCritical 9.3
Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through 3.3.0.
Product
Hitachi Coding Software Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi-ies.com
Oct 1, 2026Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on wCVE-2026-82826 · Other software · Hitachi Industrial Equipment Systems · reported by hirt@hitachi.co.jpHigh 8.7
Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Software Suite: through 3.3.0.
Product
Hitachi Coding Software Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi-ies.com
Oct 1, 2026Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function.CVE-2026-82825 · Other software · Hitachi Industrial Equipment Systems · reported by hirt@hitachi.co.jpCritical 9.3
Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. This issue affects Hitachi Coding Software Suite: through 3.3.0.
Product
Hitachi Coding Software Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi-ies.com
Oct 1, 2026Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete fileCVE-2026-82824 · Other software · Hitachi Industrial Equipment Systems · reported by hirt@hitachi.co.jpCritical 9.3
Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0.
Product
Hitachi Coding Software Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hitachi-ies.com
Oct 1, 2026In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the requiCVE-2026-78210 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.1
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.
Product
Octopus Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record advisories.octopus.com
Oct 1, 2026A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allowsCVE-2026-76147 · Other software · Genians, Inc · reported by vuln@krcert.or.krMedium 5.9
A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code
Product
Genian NAC 4.0.175 Release
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.genians.com github.com
Oct 1, 2026An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commaCVE-2026-76146 · Other software · Genians, Inc · reported by vuln@krcert.or.krHigh 8.4
An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely
Product
Genian SSL PNS (xenics_auther)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 1, 2026An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OCVE-2026-76145 · Other software · Genians, Inc · reported by vuln@krcert.or.krHigh 7.5
An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OS account by manipulating the permission column during CSV bulk user registration
Product
Genian SSL PNS (frodo-core)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 1, 2026An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to upload a dangCVE-2026-76144 · Other software · Genians, Inc · reported by vuln@krcert.or.krLow 1.8
An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to upload a dangerous file that is not an official patch
Product
Genian SSL PNS (frodo-core)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 1, 2026A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.CVE-2026-76143 · Other software · Genians, Inc · reported by vuln@krcert.or.krHigh 7.3
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.
Product
Genian SSL PNS (frodo-core)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 1, 2026Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker toCVE-2026-76142 · Other software · Genians, Inc · reported by vuln@krcert.or.krCritical 9.3
Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions
Product
Genian NAC 5.0.75 LTS Release
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.genians.com github.com
Oct 1, 2026Advanced Woo Labels – Product Labels & Badges for WooCommerce: Unauthorized modification of dataCVE-2026-12241 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46.
Product
Advanced Woo Labels – Product Labels & Badges for WooCommerce
Affected
up to 2.51
What to do
Affects up to 2.51. Update Advanced Woo Labels – Product Labels & Badges for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record kramakit.com plugins.trac.wordpress.org
Oct 1, 2026A weakness has been identified in ZongXR SuperMarket 1.0.0.0.CVE-2026-103539 · Other software · ZongXR · reported by VulDBLow 2.1
A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missing authentication. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Product
SuperMarket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 1, 2026A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0.CVE-2026-103538 · Other software · ZongXR · reported by VulDBMedium 5.5
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Product
SuperMarket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 1, 2026A vulnerability was identified in ZongXR Supermarket 1.0.0.0.CVE-2026-103536 · Other software · ZongXR · reported by VulDBMedium 5.5
A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Product
Supermarket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 1, 2026AI Engine – The Chatbot, AI Framework & MCP for: Stored Cross-Site ScriptingCVE-2026-96561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; final_checks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; run_advisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwai_advisor_data option with no schema validation o
Product
AI Engine – The Chatbot, AI Framework & MCP for
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Simply Schedule Appointments: Sensitive Information ExposureCVE-2026-92245 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment public_token values. The leaked per-appointment public_token values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization.
Product
Simply Schedule Appointments
Affected
up to 1.6.12.32
What to do
Affects up to 1.6.12.32. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026Simply Schedule Appointments: Insecure Direct Object ReferenceCVE-2026-91109 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose every co-booker's private per-appointment id_token (exposed as public_token) alongside their PII (name and email address), then use each leaked token to read, overwrite arbitrary appointment meta on, or cancel the co-booker's appointment via the same REST controller. Exploitation requires the attacker to possess a valid id_token for any single appointment within the targeted group booking.
Product
Simply Schedule Appointments
Affected
up to 1.6.12.31
What to do
Affects up to 1.6.12.31. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026A flaw was found in GEGL.CVE-2026-103641 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader.
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com bugzilla.redhat.com
Oct 1, 2026A vulnerability was determined in David-Crty databasement up to 1.7.1.CVE-2026-103534 · Other software · David-Crty · reported by VulDBLow 2.1
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded.
Product
databasement
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.