Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
148 results · page 1 of 3
Oct 29, 2026Contact Form by Supsystic: Does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headersCVE-2026-115303 · WordPress plugins & themes · reported by WPScanLow 3.7
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
- Product
- Contact Form by Supsystic
- Fixed in
- 1.11.1
- What to do
- Update Contact Form by Supsystic to 1.11.1 or newer.
Oct 29, 2026Contact Form by Supsystic: Does not restrict access to an AJAX action that deletes stored form statistics recordsCVE-2026-115302 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
- Product
- Contact Form by Supsystic
- Fixed in
- 1.11.1
- What to do
- Update Contact Form by Supsystic to 1.11.1 or newer.
Oct 29, 2026Contact Form by Supsystic: Does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engineCVE-2026-115301 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.
- Product
- Contact Form by Supsystic
- Fixed in
- 1.11.1
- What to do
- Update Contact Form by Supsystic to 1.11.1 or newer.
Oct 29, 2026Contact Form by Supsystic: Does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statisticsCVE-2026-115300 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
- Product
- Contact Form by Supsystic
- Fixed in
- 1.11.1
- What to do
- Update Contact Form by Supsystic to 1.11.1 or newer.
Oct 29, 2026Contact Form by Supsystic: Does not verify a CSRF nonce before saving its mail settingsCVE-2026-115299 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.
- Product
- Contact Form by Supsystic
- Fixed in
- 1.11.1
- What to do
- Update Contact Form by Supsystic to 1.11.1 or newer.
Oct 28, 2026Contact Form by Supsystic: Insertion of Sensitive Information Into Sent DataCVE-2026-115591 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from n/a through 1.10.5.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.10.5
- What to do
- Affects up to 1.10.5. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2026Smart Popup by Supsystic: Does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engineCVE-2026-115223 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
- Product
- Smart Popup by Supsystic
- Fixed in
- 2.0.2
- What to do
- Update Smart Popup by Supsystic to 2.0.2 or newer.
Oct 26, 2026Contact Form by Supsystic: Missing AuthorizationCVE-2026-115595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.10.7
- What to do
- Affects up to 1.10.7. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2026Contact Form by Supsystic: Does not sanitise and escape a form nameCVE-2025-15705 · WordPress plugins & themes · reported by WPScanLow 3.5
The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.
- Product
- Contact Form by Supsystic
- Fixed in
- 1.8.0
- What to do
- Update Contact Form by Supsystic to 1.8.0 or newer.
Oct 11, 2026In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index.CVE-2026-87765 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges.
- Product
- kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Data Tables Generator by Supsystic: Stored Cross-Site ScriptingCVE-2026-14877 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Data Tables Generator by Supsystic
- Affected
- up to 1.12.03
- What to do
- Affects up to 1.12.03. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 10, 2026Smart Popup by Supsystic: Generic SQL InjectionCVE-2026-104023 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Smart Popup by Supsystic
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update Smart Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Data Tables Generator by Supsystic: Stored Cross-Site ScriptingCVE-2026-96648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin's 'access_roles' setting, which is a documented and explicitly supported plugin feature that grants lower-privileged users access to the dtgs_nonce required to reach the vulnerable updateRows action handler.
- Product
- Data Tables Generator by Supsystic
- Affected
- up to 1.15.1
- What to do
- Affects up to 1.15.1. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.CVE-2026-102397 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.CVE-2026-102399 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
- Affected
- up to 1.21.0
- What to do
- Affects up to 1.21.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.CVE-2026-102398 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
- Affected
- up to 1.13.1
- What to do
- Affects up to 1.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.CVE-2026-102396 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2026In the Linux kernel, the following vulnerability has been resolved: drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel The DisplayPort AUX chaCVE-2026-93195 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel The DisplayPort AUX channel gets initialized and registered during dw_dp_bind(), but it is never unregistered, which may lead to resource leaks and/or use-after-free. Add the missing dw_dp_unbind() function to allow the users of the library to handle the required cleanup, i.e. unregister the AUX adapter.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 5, 2026Contact Form by Supsystic: Stored Cross-Site ScriptingCVE-2026-83625 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can first call the 'updateNonce' action — which is accessible without authentication due to its absence from the plugin's permission list — to obtain a valid nonce, then submit a contact form with a malicious payload in a spoofed IP header such as X-Forwarded-For.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2026Ultimate Maps by Supsystic: Missing AuthorizationCVE-2026-85309 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.
- Product
- Ultimate Maps by Supsystic
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Ultimate Maps by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_legacCVE-2026-80750 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_put() drops the last reference, the later %pOF formatting can dereference a freed device node. Keep the node reference until after the error message has been emitted in the infracfg and SMI lookup paths. Also drop the SMI node before returning when the SMI phandle is missing.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 28, 2026phpSysInfo is a customizable PHP script that displays system information.CVE-2026-55584 · Websites & servers · phpsysinfo · reported by GitHubHigh 7.5
phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.
- Product
- phpsysinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73381 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
- Affected
- up to 1.13.0
- What to do
- Affects up to 1.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
- Affected
- up to 1.13.0
- What to do
- Affects up to 1.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-73379 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-73378 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-73377 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-73376 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-73375 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.CVE-2026-27537 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.
- Affected
- up to 1.11.2
- What to do
- Affects up to 1.11.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deployCVE-2026-17032 · WordPress plugins & themes · reported by WPScanCritical 9.8
Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.
- What to do
- Update the plugin to the newest version.
Aug 5, 2026Smart Popup by Supsystic: Privilege EscalationCVE-2026-18322 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing `save` from protected actions; this is compounded by the subscription confirmation email embedding the same generic `pps_nonce` that the unauthenticated `wp_ajax_nopriv_save` endpoint accepts, and by the complete absence of any server-side role allowlist in `createWpSubscriber()`. This makes it possible for unauthenticated attackers to submit a crafted POST request to `admin-ajax.php` using a nonce obtained from a public subscription confirmation email, setting `params[tpl][sub_wp_create_user_role]` to `administrator` via the exposed `popupControllerPps::save()` action, and then triggering the stored confirmation flow to create a persistent WordPress Administrator account with attacker-chosen credentials.
- Product
- Smart Popup by Supsystic
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update Smart Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2026In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback CVE-2026-10683 · Other software · zephyrproject · reported by vulnerabilities@zephyrproject.orgLow 2.4
In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START, was never added to the enabled interrupt mask in i2c_dw_slave_register(), so that recovery path was dead code. As a result, if the STOP interrupt is lost (bus glitch/reset, or a concurrent master driving STOP) or the bus master issues a legal WRITE-repeated-START-WRITE sequence with the same direction, the driver remains in CMD_SEND permanently and never invokes write_requested() again for the life of the target. An I2C master on the same physical bus can deliberately trigger this, causing the I2C target function to malfunction for all subsequent write transactions and desynchronizing consumer framing state (e.g. MCTP-over-I2C), a recoverable-by-reset denial of service of the target peripheral. The fix unmasks START_DET so the state is reset at every bus (re)START. Impact is availability-only over a local board-level bus;
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.CVE-2026-24628 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
- Affected
- up to 1.16.3
- What to do
- Affects up to 1.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2026In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path isp->psys is confirmed toCVE-2026-46313 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path isp->psys is confirmed to be an error pointer not NULL so this condition is true and the error pointer is dereferenced. So isp-psys should be set to NULL before going to out_ipu6_bus_del_devices. Detected by Smatch: drivers/media/pci/intel/ipu6/ipu6.c:690 ipu6_pci_probe() error: 'isp->psys' dereferencing possible ERR_PTR() [Sakari Ailus: Fix commit message.]
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 8, 2026In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_getCVE-2026-46308 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The function then calls of_node_put(node) before checking whether syscon_regmap_lookup_by_phandle() returns an error. If an error occurs, dev_err_probe() dereferences the node pointer to print diagnostic information, but the node memory may have already been freed due to the earlier of_node_put(), leading to a use-after-free vulnerability. Fix this by moving the of_node_put() call after the error check, ensuring the node is still valid when accessed in the error path.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 16, 2026Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating thCVE-2020-37246 · Other software · Supsystic · reported by VulnCheckMedium 6.9
Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.
- Product
- Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.wordpress.orgsupsystic.com
May 16, 2026Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web rooCVE-2020-37245 · Other software · Supsystic · reported by VulnCheckHigh 8.7
Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by injecting directory traversal sequences. Additionally, the plugin fails to sanitize input fields in publication settings, allowing stored cross-site scripting attacks through script injection in parameters like Area Width and Publication Width that execute when publications are viewed or edited.
- Product
- Digital Publications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.wordpress.orgsupsystic.com
May 16, 2026Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciousCVE-2020-37244 · Other software · Supsystic · reported by VulnCheckHigh 8.8
Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database information using time-based blind or UNION-based SQL injection techniques.
- Product
- Membership
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.wordpress.orgsupsystic.com
May 16, 2026Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQLCVE-2020-37243 · Other software · Supsystic · reported by VulnCheckHigh 8.8
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that execute malicious scripts when viewing pricing tables.
- Product
- Pricing Table
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.wordpress.orgsupsystic.com
May 16, 2026Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicCVE-2020-37242 · Other software · Supsystic · reported by VulnCheckHigh 8.8
Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'sidx' GET parameter. Attackers can send crafted requests to the getListForTbl action with boolean-based blind or time-based blind SQL injection payloads to extract sensitive database information.
- Product
- Ultimate Maps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.wordpress.orgsupsystic.com
Mar 30, 2026Contact Form by Supsystic: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE)CVE-2026-4257 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` template engine without sandboxing, combined with the `cfsPreFill` prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible for unauthenticated attackers to execute arbitrary PHP functions and OS commands on the server by leveraging Twig's `registerUndefinedFilterCallback()` method to register arbitrary PHP callbacks.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.7.36
- What to do
- Affects up to 1.7.36. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2026In the Linux kernel, the following vulnerability has been resolved: drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind Fix several issues in dw_dp_binCVE-2026-23132 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind Fix several issues in dw_dp_bind() error handling: 1. Missing return after drm_bridge_attach() failure - the function continued execution instead of returning an error. 2. Resource leak: drm_dp_aux_register() is not a devm function, so drm_dp_aux_unregister() must be called on all error paths after aux registration succeeds. This affects errors from: - drm_bridge_attach() - phy_init() - devm_add_action_or_reset() - platform_get_irq() - devm_request_threaded_irq() 3. Bug fix: platform_get_irq() returns the IRQ number or a negative error code, but the error path was returning ERR_PTR(ret) instead of ERR_PTR(dp->irq). Use a goto label for cleanup to ensure consistent error handling.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 30, 2026PsySH is a runtime developer console, interactive debugger, and REPL for PHP.CVE-2026-25129 · Other software · bobthecow · reported by GitHubMedium 6.7
PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a `.psysh.php` file from the Current Working Directory (CWD) on startup. If an attacker can write to a directory that a victim later uses as their CWD when launching PsySH, the attacker can trigger arbitrary code execution in the victim's context. When the victim runs PsySH with elevated privileges (e.g., root), this results in local privilege escalation. This is a CWD configuration poisoning issue leading to arbitrary code execution in the victim user’s context. If a privileged user (e.g., root, a CI runner, or an ops/debug account) launches PsySH with CWD set to an attacker-writable directory containing a malicious `.psysh.php`, the attacker can execute commands with that privileged user’s permissions, resulting in local privilege escalation. Downstream consumers that embed PsySH inherit this risk. For example, Laravel Tinker (`php artisan tinker`) uses PsySH. If a privileged user runs Tinker while their shell is in an attacker-writable directory, the `.psysh.php` auto-load behavior can be abused in the same way to execute att
- Product
- psysh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Data Tables Generator by Supsystic: Arbitrary file deletionCVE-2025-12089 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Data Tables Generator by Supsystic
- Affected
- up to 1.10.45
- What to do
- Affects up to 1.10.45. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 22, 2025Contact Form by Supsystic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52753 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Reflected XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.36.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.7.36
- What to do
- Affects up to 1.7.36. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 4, 2025In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check.CVE-2025-26422 · Computers, phones & browsers · Google · reported by security@android.comMedium 4
In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Apr 15, 2025Contact Form by Supsystic: Cross-Site Request ForgeryCVE-2024-13452 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.29. This is due to missing or incorrect nonce validation on a saveAsCopy function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.7.29
- What to do
- Affects up to 1.7.29. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 17, 2025Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to vCVE-2024-11923 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffMedium 5.5
Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to version 1.3
- Product
- Fortra Application Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025Data Tables Generator by Supsystic: Missing AuthorizationCVE-2024-56253 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in supsystic Data Tables Generator by Supsystic data-tables-generator-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Data Tables Generator by Supsystic: from n/a through <= 1.10.36.
- Product
- Data Tables Generator by Supsystic
- Affected
- up to 1.10.36
- What to do
- Affects up to 1.10.36. Update Data Tables Generator by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.