THREAT OPS › Threat News

Threat Intelligence News

11596 reports from 110+ open cyber-threat-intelligence sources — APT activity, malware, vulnerabilities and campaigns, newest first.

[NVD] CVE-2026-86168 (HIGH 7.3) — A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the file /login.php. The manipulation of the argument user_name results in sql injection. The attack can be executed remotely. The exploit has been rnvd · 2026-09-06
[NVD] CVE-2026-86167 (CRITICAL 9.9) — A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. Tnvd · 2026-09-06
[NVD] CVE-2026-86166 (HIGH 8.8) — A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotenvd · 2026-09-06
[NVD] CVE-2026-86165 (CRITICAL 9.8) — A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been manvd · 2026-09-06
[NVD] CVE-2026-86164 (MEDIUM 6.3) — A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/trans_view.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been releanvd · 2026-09-06
[NVD] CVE-2026-86163 (MEDIUM 6.3) — A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly anvd · 2026-09-06
[NVD] CVE-2026-86162 (HIGH 7.3) — A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been pnvd · 2026-09-06
[NVD] CVE-2026-86161 (HIGH 7.3) — A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. Thnvd · 2026-09-06
[NVD] CVE-2026-86160 (HIGH 7.3) — A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has beenvd · 2026-09-06
[NVD] CVE-2026-86159 (HIGH 7.3) — A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be usenvd · 2026-09-06
[NVD] CVE-2026-75816 (CRITICAL 9.8) — The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logicnvd · 2026-09-06
[NVD] CVE-2026-18056 (HIGH 7.5) — The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwardingnvd · 2026-09-06
[NVD] CVE-2026-16310 (CRITICAL 9.8) — The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the passwordnvd · 2026-09-06
[NVD] CVE-2026-86153 (CRITICAL 9.1) — A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.nvd · 2026-09-06
[NVD] CVE-2026-86152 (CRITICAL 10.0) — A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely.nvd · 2026-09-06
[NVD] CVE-2026-86151 (CRITICAL 9.1) — A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.nvd · 2026-09-06
[NVD] CVE-2026-86150 (MEDIUM 4.1) — A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been dinvd · 2026-09-05
[NVD] CVE-2026-86149 (CRITICAL 9.1) — A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated remotely.nvd · 2026-09-05
[NVD] CVE-2026-86148 (CRITICAL 9.1) — A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack renvd · 2026-09-05
[direwolf] Mission Pet Health posted to leak siteransomware_live · 2026-09-05
[kazu] Spirit Cultural Exchange - US posted to leak siteransomware_live · 2026-09-05
Fwd: Security vulnerabilities fixed in WeeChat 4.10.1oss_sec · 2026-09-05
[NVD] CVE-2026-86060 — RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reacnvd · 2026-09-05
[NVD] CVE-2026-67281 — RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving patnvd · 2026-09-05
[NVD] CVE-2026-67279 — RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unnvd · 2026-09-05
[NVD] CVE-2026-67278 — MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - tonvd · 2026-09-05
[NVD] CVE-2026-67277 — RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet bnvd · 2026-09-05
[NVD] CVE-2026-67276 — RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorizednvd · 2026-09-05
[NVD] CVE-2026-6554 (MEDIUM 5.5) — libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop invd · 2026-09-05
[NVD] CVE-2026-31912 (MEDIUM 5.5) — libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter programnvd · 2026-09-05
[NVD] CVE-2026-18313 (MEDIUM 4.3) — rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially fasnvd · 2026-09-05
[NVD] CVE-2026-18238 (MEDIUM 5.0) — The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if nvd · 2026-09-05
[NVD] CVE-2026-0799 (HIGH 8.7) — In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause thenvd · 2026-09-05
[thegentlemen] Leo Schachter Diamonds posted to leak siteransomware_live · 2026-09-05
[thegentlemen] Zdrowit posted to leak siteransomware_live · 2026-09-05
[thegentlemen] Veradigm posted to leak siteransomware_live · 2026-09-05
[thegentlemen] Lider Aviacao posted to leak siteransomware_live · 2026-09-05
[NVD] CVE-2026-82752 — Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which counts Unicode graphnvd · 2026-09-05
[Vexy Ransomware] Mega Velocity posted to leak siteransomware_live · 2026-09-05
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentialsthehackernews · 2026-09-05
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Codethehackernews · 2026-09-05
[DYSPHOR1A] CitizensPay posted to leak siteransomware_live · 2026-09-05
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deletedthehackernews · 2026-09-05
[qilin] Philippine Ports Authority posted to leak siteransomware_live · 2026-09-05
[qilin] Bauman Law Group posted to leak siteransomware_live · 2026-09-05
[NVD] CVE-2026-86190 (CRITICAL 9.1) — WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the dnvd · 2026-09-05
[NVD] CVE-2026-86189 (CRITICAL 9.8) — WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext anvd · 2026-09-05
[NVD] CVE-2026-86188 (HIGH 7.2) — AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resonvd · 2026-09-05
[NVD] CVE-2026-86187 (MEDIUM 5.9) — WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force attacks due to unsalted Mnvd · 2026-09-05
[NVD] CVE-2026-86186 (MEDIUM 6.5) — AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited nvd · 2026-09-05
[NVD] CVE-2026-86185 (HIGH 8.0) — Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed nvd · 2026-09-05
[NVD] CVE-2026-86184 (CRITICAL 9.8) — Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint winvd · 2026-09-05
[NVD] CVE-2026-15550 (MEDIUM 4.3) — The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attacnvd · 2026-09-05
[NVD] CVE-2026-12843 (MEDIUM 5.4) — The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary usersnvd · 2026-09-05
[NVD] CVE-2026-10196 (CRITICAL 9.8) — The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' function. This makes invd · 2026-09-05
[NVD] CVE-2025-9049 (HIGH 8.8) — The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated nvd · 2026-09-05
[NVD] CVE-2025-15647 (MEDIUM 5.5) — CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating point and round outside adjacent triangles. Attackers can supply nearly-degenerate constraint edges through geometry data tnvd · 2026-09-05
[NVD] CVE-2025-15614 (LOW 3.3) — ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the procesnvd · 2026-09-05
Re: Vulnerabilities fixed in libxml2-2.15.4oss_sec · 2026-09-05
Re: pcre2 version 10.48 released with security fixesoss_sec · 2026-09-05
Re: Vulnerability fixes in util-linux-2.42.3oss_sec · 2026-09-05
[qilin] Jouvet SAS posted to leak siteransomware_live · 2026-09-05
[qilin] G&S Technologies posted to leak siteransomware_live · 2026-09-05
[qilin] Nolan Consulting Group posted to leak siteransomware_live · 2026-09-05
[qilin] Colonial Hyundai posted to leak siteransomware_live · 2026-09-05
[qilin] The Big Table posted to leak siteransomware_live · 2026-09-05
[NVD] CVE-2026-86178 (MEDIUM 5.4) — Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLnvd · 2026-09-05
[NVD] CVE-2026-86177 (HIGH 8.8) — Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-servenvd · 2026-09-05
[NVD] CVE-2026-86176 (MEDIUM 4.3) — NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users nvd · 2026-09-05
[NVD] CVE-2026-86175 (MEDIUM 6.5) — NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorinvd · 2026-09-05
[NVD] CVE-2026-86174 (MEDIUM 4.3) — Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.nvd · 2026-09-05
[NVD] CVE-2026-86173 (HIGH 7.5) — MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting nvd · 2026-09-05
[NVD] CVE-2026-86169 (HIGH 8.8) — Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Facenvd · 2026-09-05
[NVD] CVE-2026-86124 (CRITICAL 9.8) — AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the containnvd · 2026-09-05
[NVD] CVE-2026-86123 (HIGH 8.7) — SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot intonvd · 2026-09-05
[NVD] CVE-2026-86122 (MEDIUM 5.0) — Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate intenvd · 2026-09-05
[NVD] CVE-2026-86121 (CRITICAL 9.8) — Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands vinvd · 2026-09-05
[NVD] CVE-2026-86120 (MEDIUM 4.3) — APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets thenvd · 2026-09-05
[NVD] CVE-2026-86119 (HIGH 8.6) — Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instannvd · 2026-09-05
[NVD] CVE-2026-86118 (MEDIUM 4.3) — gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing dnvd · 2026-09-05
[NVD] CVE-2026-86117 (HIGH 8.1) — Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email adnvd · 2026-09-05
[NVD] CVE-2026-86116 (MEDIUM 6.5) — Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instanvd · 2026-09-05
[NVD] CVE-2026-86115 (MEDIUM 5.0) — Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting witnvd · 2026-09-05
[NVD] CVE-2026-86114 (MEDIUM 6.5) — Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or honvd · 2026-09-05
[NVD] CVE-2026-86113 (MEDIUM 6.5) — BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates,nvd · 2026-09-05
[NVD] CVE-2026-86112 (MEDIUM 5.4) — BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status Invd · 2026-09-05
[NVD] CVE-2026-86111 (MEDIUM 6.5) — BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses tnvd · 2026-09-05
[aurora] Metrea LLC/Commuter Air Technology, Inc. posted to leak siteransomware_live · 2026-09-05
[NVD] CVE-2026-76573 (MEDIUM 6.4) — The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for aunvd · 2026-09-05
[NVD] CVE-2024-11080 (CRITICAL 9.8) — The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to exnvd · 2026-09-05
[NVD] CVE-2026-85414 (MEDIUM 6.4) — The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atnvd · 2026-09-05
[NVD] CVE-2026-83625 (HIGH 7.2) — The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to invd · 2026-09-05
[NVD] CVE-2026-81543 (HIGH 8.8) — The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap_save_connector_settings, wcap_senvd · 2026-09-05
[NVD] CVE-2026-75586 (MEDIUM 6.1) — The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[id]' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticatnvd · 2026-09-05
[NVD] CVE-2026-75018 (MEDIUM 4.3) — The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, witnvd · 2026-09-05
Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channelthehackernews · 2026-09-05
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universitiesthehackernews · 2026-09-05
[NVD] CVE-2026-84937 (MEDIUM 6.8) — The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database.nvd · 2026-09-05
[NVD] CVE-2026-84936 (MEDIUM 5.3) — The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounnvd · 2026-09-05
[NVD] CVE-2026-84935 (HIGH 8.0) — The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to stornvd · 2026-09-05