PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

15,742 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-94228 — The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the tok…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.

    CVE-2026-94228
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-91831 — The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name…

    Low · CVSS 3.1 3.8 · Assessor: [email protected]

    The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

    CVE-2026-91831
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-86791 — The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually compl…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.

    CVE-2026-86791
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-74922 — The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endp…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.

    CVE-2026-74922
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-74921 — The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before…

    Medium · CVSS 3.1 6.8 · Assessor: [email protected]

    The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.

    CVE-2026-74921
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-16460 — A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's contain…

    High · CVSS 3.1 7.4 · Assessor: [email protected]

    A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

    CVE-2026-16460
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-112089 — A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a58…

    Low · CVSS 4.0 2.0 · Assessor: [email protected]

    A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version info…

    CVE-2026-112089
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-112088 — A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b6…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affecte…

    CVE-2026-112088
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-112087 — A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing o…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file confirm.php. This manipulation of the argument cancel causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

    CVE-2026-112087
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-110034 — The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount…

    Low · CVSS 3.1 3.7 · Assessor: [email protected]

    The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.

    CVE-2026-110034
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-106010 — The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.

    CVE-2026-106010
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-103311 — The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of inc…

    Medium · CVSS 3.1 5.3 · Assessor: [email protected]

    The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.

    CVE-2026-103311
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-94273 — The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a co…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.

    CVE-2026-94273
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-91047 — The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooComm…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.

    CVE-2026-91047
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-91046 — The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execut…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.

    CVE-2026-91046
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-89286 — The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside th…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.

    CVE-2026-89286
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-112086 — A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publicatio…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.

    CVE-2026-112086
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-112083 — A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights…

    Medium · CVSS 4.0 5.5 · Assessor: [email protected]

    A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

    CVE-2026-112083
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-112082 — A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_h…

    High · CVSS 4.0 7.7 · Assessor: [email protected]

    A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

    CVE-2026-112082
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-112081 — A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-112081
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-108121 — Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Ser…

    Medium · CVSS 4.0 6.9 · Assessor: [email protected]

    Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.

    CVE-2026-108121
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-108120 — Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali'…

    High · CVSS 4.0 7.7 · Assessor: [email protected]

    Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.

    CVE-2026-108120
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-106933 — The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type…

    Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.

    CVE-2026-106933
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.