PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

Every cached source, newest first. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

16,574 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates · Some delayed

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-110883 — Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-vide…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.

    CVE-2026-110883
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-110880 — Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Acc…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.

    CVE-2026-110880
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-110383 — Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Form…

    High · CVSS 3.1 7.5 · Assessor: [email protected]

    Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.

    CVE-2026-110383
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-110382 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedu…

    High · CVSS 3.1 7.1 · Assessor: [email protected]

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.

    CVE-2026-110382
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-110365 — Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly C…

    Medium · CVSS 3.1 6.5 · Assessor: [email protected]

    Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.

    CVE-2026-110365
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-96534 — The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 doe…

    High · CVSS 3.1 7.7 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

    CVE-2026-96534
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-87844 — The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and i…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.

    CVE-2026-87844
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-111942 — A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the fi…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

    CVE-2026-111942
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-111877 — A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an u…

    Low · CVSS 4.0 2.1 · Assessor: [email protected]

    A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.

    CVE-2026-111877
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-111041 — The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions own…

    Medium · CVSS 3.1 4.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.

    CVE-2026-111041
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-110981 — The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before refle…

    High · CVSS 3.1 7.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.

    CVE-2026-110981
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-110976 — The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the r…

    Medium · CVSS 3.1 4.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.

    CVE-2026-110976
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-110070 — The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.

    CVE-2026-110070
    Read original (opens in a new tab)
  20. NVD

    CVE-2026-110069 — The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks befor…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.

    CVE-2026-110069
    Read original (opens in a new tab)
  21. NVD

    CVE-2026-110035 — The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, al…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.

    CVE-2026-110035
    Read original (opens in a new tab)
  22. NVD

    CVE-2026-110033 — The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it ser…

    Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.

    CVE-2026-110033
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-110032 — The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edi…

    Medium · CVSS 3.1 5.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.

    CVE-2026-110032
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-110031 — The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from as…

    High · CVSS 3.1 7.2 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.

    CVE-2026-110031
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-110026 — The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and…

    Medium · CVSS 3.1 4.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.

    CVE-2026-110026
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.