THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,871 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-91830 — The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter…
Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.
CVE-2026-91830Read original ↗ (opens in a new tab) - NVD
CVE-2026-74923 — The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gal…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.
CVE-2026-74923Read original ↗ (opens in a new tab) - NVD
CVE-2026-19867 — Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and siz…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MM…
CVE-2026-19867Read original ↗ (opens in a new tab) - NVD
CVE-2026-19798 — The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_de…
CVE-2026-19798Read original ↗ (opens in a new tab) - NVD
CVE-2026-19603 — Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active ch…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765
CVE-2026-19603Read original ↗ (opens in a new tab) - NVD
CVE-2026-19601 — Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored…
Medium · CVSS 3.1 4.9 · Assessor: [email protected]
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764
CVE-2026-19601Read original ↗ (opens in a new tab) - NVD
CVE-2026-19541 — Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of th…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761
CVE-2026-19541Read original ↗ (opens in a new tab) - NVD
CVE-2026-18795 — Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756
CVE-2026-18795Read original ↗ (opens in a new tab) - NVD
CVE-2026-18551 — Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combinatio…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.. Mattermost Advisory ID: MMSA-2026-00752
CVE-2026-18551Read original ↗ (opens in a new tab) - NVD
CVE-2026-15222 — The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom U…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary sho…
CVE-2026-15222Read original ↗ (opens in a new tab) - NVD
CVE-2026-111178 — The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]'…
Medium · CVSS 3.1 4.9 · Assessor: [email protected]
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the…
CVE-2026-111178Read original ↗ (opens in a new tab) - NVD
CVE-2026-111069 — The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stor…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The client-side HTML pattern attrib…
CVE-2026-111069Read original ↗ (opens in a new tab) - NVD
CVE-2026-110701 — The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle'…
High · CVSS 3.1 7.2 · Assessor: [email protected]
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one calendar view, which…
CVE-2026-110701Read original ↗ (opens in a new tab) - NVD
CVE-2026-110664 — The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses tag-based filtering because the payload is stored as a…
CVE-2026-110664Read original ↗ (opens in a new tab) - NVD
CVE-2026-110366 — Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4.
CVE-2026-110366Read original ↗ (opens in a new tab) - NVD
CVE-2026-110290 — The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attri…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + undeclared is_widget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires sett…
CVE-2026-110290Read original ↗ (opens in a new tab) - NVD
CVE-2026-110252 — The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and incl…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign's last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item->get_content(), only entity-decod…
CVE-2026-110252Read original ↗ (opens in a new tab) - NVD
CVE-2026-110191 — The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosin…
Low · CVSS 3.1 2.7 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
CVE-2026-110191Read original ↗ (opens in a new tab) - NVD
CVE-2026-110179 — The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before…
Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
CVE-2026-110179Read original ↗ (opens in a new tab) - NVD
CVE-2026-110135 — The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification…
High · CVSS 3.1 7.4 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.
CVE-2026-110135Read original ↗ (opens in a new tab) - NVD
CVE-2026-110039 — The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators…
Low · CVSS 3.1 2.7 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.
CVE-2026-110039Read original ↗ (opens in a new tab) - NVD
CVE-2026-110015 — The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and…
High · CVSS 3.1 8.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted link to forge requests in that administrator's browser, up to creating a new administrator account.
CVE-2026-110015Read original ↗ (opens in a new tab) - NVD
CVE-2026-110014 — The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment.
CVE-2026-110014Read original ↗ (opens in a new tab) - NVD
CVE-2026-110013 — The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure rando…
Medium · CVSS 3.1 4.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
CVE-2026-110013Read original ↗ (opens in a new tab) - NVD
CVE-2026-110012 — The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users w…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
CVE-2026-110012Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.