THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
18,833 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-109930 — The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
CVE-2026-109930Read original ↗ (opens in a new tab) - NVD
CVE-2026-107648 — The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ac…
High · CVSS 3.1 7.2 · Assessor: [email protected]
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-107648Read original ↗ (opens in a new tab) - NVD
CVE-2026-105959 — A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when cal…
High · CVSS 3.1 7.5 · Assessor: [email protected]
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
CVE-2026-105959Read original ↗ (opens in a new tab) - NVD
CVE-2026-109119 — Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authentic…
High · CVSS 3.1 8.8 · Assessor: [email protected]
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
CVE-2026-109119Read original ↗ (opens in a new tab) - NVD
CVE-2026-109118 — Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history…
Medium · CVSS 3.1 4.6 · Assessor: [email protected]
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on…
CVE-2026-109118Read original ↗ (opens in a new tab) - NVD
CVE-2026-96768 — The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in a…
High · CVSS 3.1 7.2 · Assessor: [email protected]
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moder…
CVE-2026-96768Read original ↗ (opens in a new tab) - NVD
CVE-2026-14452 — Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.…
High · CVSS 4.0 8.6 · Assessor: [email protected]
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.
CVE-2026-14452Read original ↗ (opens in a new tab) - NVD
CVE-2026-110703 — The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stor…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to own a pu…
CVE-2026-110703Read original ↗ (opens in a new tab) - NVD
CVE-2026-107649 — The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parame…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location crea…
CVE-2026-107649Read original ↗ (opens in a new tab) - NVD
CVE-2026-106030 — NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manu…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe "\\.\pipe\nord-security\v1\NordVpnService\Server". The attacker can then invoke the "ISettingsGrpc.StopService" and "ISettingsGrpc.ChangeServiceStartType" methods with an arbitrary service name, allowing them to stop any unprotected Windows service a…
CVE-2026-106030Read original ↗ (opens in a new tab) - NVD
CVE-2026-93681 — The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via d…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Legal Consent record exists for the attacker's…
CVE-2026-93681Read original ↗ (opens in a new tab) - NVD
CVE-2026-92766 — The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_b…
High · CVSS 3.1 7.5 · Assessor: [email protected]
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unau…
CVE-2026-92766Read original ↗ (opens in a new tab) - NVD
CVE-2026-15575 — Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This i…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-15575Read original ↗ (opens in a new tab) - NVD
CVE-2026-15219 — Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitati…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-15219Read original ↗ (opens in a new tab) - NVD
CVE-2026-14177 — Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprin…
High · CVSS 3.1 7.5 · Assessor: [email protected]
Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.
CVE-2026-14177Read original ↗ (opens in a new tab) - NVD
CVE-2026-111472 — An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, c…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.
CVE-2026-111472Read original ↗ (opens in a new tab) - NVD
CVE-2026-111311 — The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plu…
High · CVSS 3.1 8.8 · Assessor: [email protected]
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user…
CVE-2026-111311Read original ↗ (opens in a new tab) - NVD
CVE-2026-109224 — The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments pl…
High · CVSS 3.1 7.2 · Assessor: [email protected]
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected c…
CVE-2026-109224Read original ↗ (opens in a new tab) - NVD
CVE-2026-104726 — The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all ve…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-104726Read original ↗ (opens in a new tab) - NVD
CVE-2026-104003 — The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and passing the entire buffer to do_shortcode() after only a narrow neutralization pass (ppress_neutralize_buffer_shortcodes) that blocks pp-custom-html and bracket fragments containing HTML delimiters bu…
CVE-2026-104003Read original ↗ (opens in a new tab) - NVD
CVE-2026-101300 — Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the re…
High · CVSS 4.0 7.1 · Assessor: [email protected]
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary…
CVE-2026-101300Read original ↗ (opens in a new tab) - NVD
CVE-2026-96870 — The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t…
Medium · CVSS 3.1 6.4 · Assessor: [email protected]
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like…
CVE-2026-96870Read original ↗ (opens in a new tab) - NVD
CVE-2026-87111 — The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is…
High · CVSS 3.1 7.2 · Assessor: [email protected]
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin…
CVE-2026-87111Read original ↗ (opens in a new tab) - NVD
CVE-2026-75903 — The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3…
High · CVSS 3.1 8.1 · Assessor: [email protected]
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.
CVE-2026-75903Read original ↗ (opens in a new tab) - NVD
CVE-2026-19621 — Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integratio…
Medium · CVSS 3.1 6.5 · Assessor: [email protected]
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766
CVE-2026-19621Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.