THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
17,017 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-107594 — The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controll…
Critical · CVSS 3.1 10.0 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
CVE-2026-107594Read original ↗ (opens in a new tab) - NVD
CVE-2026-107508 — The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to inclu…
High · CVSS 3.1 8.6 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.
CVE-2026-107508Read original ↗ (opens in a new tab) - NVD
CVE-2026-107320 — The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing una…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
CVE-2026-107320Read original ↗ (opens in a new tab) - NVD
CVE-2026-107319 — The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its auth…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.
CVE-2026-107319Read original ↗ (opens in a new tab) - NVD
CVE-2026-107178 — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration value…
Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.
CVE-2026-107178Read original ↗ (opens in a new tab) - NVD
CVE-2026-107160 — The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allowing unauthenticated users to inject HTML and links that are rendered to visitors on the storefront.
CVE-2026-107160Read original ↗ (opens in a new tab) - NVD
CVE-2026-107158 — The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its R…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.
CVE-2026-107158Read original ↗ (opens in a new tab) - NVD
CVE-2026-107126 — The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value befor…
High · CVSS 3.1 8.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.
CVE-2026-107126Read original ↗ (opens in a new tab) - NVD
CVE-2026-106646 — The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing…
Medium · CVSS 3.1 5.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.
CVE-2026-106646Read original ↗ (opens in a new tab) - NVD
CVE-2026-106469 — The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is…
Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in the session of any user who views or previews the affected form, such as an administrator reviewing a pending post.
CVE-2026-106469Read original ↗ (opens in a new tab) - NVD
CVE-2026-106166 — The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks befor…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
CVE-2026-106166Read original ↗ (opens in a new tab) - NVD
CVE-2026-106099 — The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, ga…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
CVE-2026-106099Read original ↗ (opens in a new tab) - NVD
CVE-2026-106098 — The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endp…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
CVE-2026-106098Read original ↗ (opens in a new tab) - NVD
CVE-2026-105975 — The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment co…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts.
CVE-2026-105975Read original ↗ (opens in a new tab) - NVD
CVE-2026-105969 — The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted qu…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable identifier.
CVE-2026-105969Read original ↗ (opens in a new tab) - NVD
CVE-2026-105261 — The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plu…
Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.
CVE-2026-105261Read original ↗ (opens in a new tab) - NVD
CVE-2026-104751 — The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SE…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.
CVE-2026-104751Read original ↗ (opens in a new tab) - NVD
CVE-2026-104644 — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration va…
Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.
CVE-2026-104644Read original ↗ (opens in a new tab) - NVD
CVE-2026-103307 — The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input…
High · CVSS 3.1 8.6 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.
CVE-2026-103307Read original ↗ (opens in a new tab) - NVD
CVE-2026-94370 — A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quic…
Medium · CVSS 4.0 6.5 · Assessor: a59d8014-47c4-4630-ab43-e1b13cbe58e3
A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.
CVE-2026-94370Read original ↗ (opens in a new tab) - NVD
CVE-2026-50218 — Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.…
High · CVSS 3.1 8.5 · Assessor: [email protected]
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.
CVE-2026-50218Read original ↗ (opens in a new tab) - NVD
CVE-2026-50217 — A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local lo…
Medium · CVSS 3.1 4.7 · Assessor: [email protected]
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool groomin…
CVE-2026-50217Read original ↗ (opens in a new tab) - NVD
CVE-2026-50216 — An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Gu…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflows to a near-SIZE_MAX value, causing an allocation failure and uncaught Objective-C exception that aborts the root system extension.
CVE-2026-50216Read original ↗ (opens in a new tab) - NVD
CVE-2026-110459 — A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect A…
High · CVSS 3.1 8.6 · Assessor: fe490ce8-0395-4072-90d8-2707e1bdf984
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.
CVE-2026-110459Read original ↗ (opens in a new tab) - NVD
CVE-2026-110458 — A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found…
Low · CVSS 3.1 3.7 · Assessor: fe490ce8-0395-4072-90d8-2707e1bdf984
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.
CVE-2026-110458Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.