THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,461 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-111877 — A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an u…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.
CVE-2026-111877Read original ↗ (opens in a new tab) - NVD
CVE-2026-111041 — The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions own…
Medium · CVSS 3.1 4.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.
CVE-2026-111041Read original ↗ (opens in a new tab) - NVD
CVE-2026-110981 — The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before refle…
High · CVSS 3.1 7.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
CVE-2026-110981Read original ↗ (opens in a new tab) - NVD
CVE-2026-110976 — The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the r…
Medium · CVSS 3.1 4.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.
CVE-2026-110976Read original ↗ (opens in a new tab) - NVD
CVE-2026-110070 — The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target…
Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
CVE-2026-110070Read original ↗ (opens in a new tab) - NVD
CVE-2026-110069 — The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks befor…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
CVE-2026-110069Read original ↗ (opens in a new tab) - NVD
CVE-2026-110035 — The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, al…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.
CVE-2026-110035Read original ↗ (opens in a new tab) - NVD
CVE-2026-110033 — The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it ser…
Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.
CVE-2026-110033Read original ↗ (opens in a new tab) - NVD
CVE-2026-110032 — The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edi…
Medium · CVSS 3.1 5.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.
CVE-2026-110032Read original ↗ (opens in a new tab) - NVD
CVE-2026-110031 — The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from as…
High · CVSS 3.1 7.2 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.
CVE-2026-110031Read original ↗ (opens in a new tab) - NVD
CVE-2026-110026 — The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and…
Medium · CVSS 3.1 4.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.
CVE-2026-110026Read original ↗ (opens in a new tab) - NVD
CVE-2026-109937 — The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before…
Medium · CVSS 3.1 5.4 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
CVE-2026-109937Read original ↗ (opens in a new tab) - NVD
CVE-2026-111876 — A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of…
Low · CVSS 4.0 1.9 · Assessor: [email protected]
A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label "not planned".
CVE-2026-111876Read original ↗ (opens in a new tab) - NVD
CVE-2026-111875 — A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown function…
Low · CVSS 4.0 2.0 · Assessor: [email protected]
A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.
CVE-2026-111875Read original ↗ (opens in a new tab) - NVD
CVE-2026-111874 — A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of…
Low · CVSS 4.0 2.9 · Assessor: [email protected]
A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade…
CVE-2026-111874Read original ↗ (opens in a new tab) - NVD
CVE-2026-111873 — A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. Thi…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or…
CVE-2026-111873Read original ↗ (opens in a new tab) - NVD
CVE-2026-111872 — A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The manipulation of the argument id/user/topic leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling relea…
CVE-2026-111872Read original ↗ (opens in a new tab) - NVD
CVE-2026-111871 — A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. T…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected a…
CVE-2026-111871Read original ↗ (opens in a new tab) - NVD
CVE-2026-111870 — A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e24…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.…
CVE-2026-111870Read original ↗ (opens in a new tab) - NVD
CVE-2026-111869 — A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVE-2026-111869Read original ↗ (opens in a new tab) - NVD
CVE-2026-111997 — ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via m…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
CVE-2026-111997Read original ↗ (opens in a new tab) - NVD
CVE-2026-111868 — A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-111868Read original ↗ (opens in a new tab) - NVD
CVE-2026-111866 — A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the functio…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The reported GitHub issue was closed with the reason "completed". However, it was not possible to deter…
CVE-2026-111866Read original ↗ (opens in a new tab) - NVD
CVE-2026-111865 — A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the functi…
Low · CVSS 4.0 1.9 · Assessor: [email protected]
A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of directives in dynamically evaluated code. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why infor…
CVE-2026-111865Read original ↗ (opens in a new tab) - NVD
CVE-2026-111934 — Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, c…
Medium · CVSS 4.0 6.3 · Assessor: [email protected]
Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.
CVE-2026-111934Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.