Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-26 13:29Z
2026-08-05
2026-08-05 08:16Z
CRIT

CVE-2026-71213 — POST: Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71213

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. The only attempt-counting/lockout logic present in the same file protects an optional secondary email-authcode step and does not apply CVSSv3.1 9.1 (CRITICAL)

CWECWE 307VNDPostTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-05
2026-08-05 08:16Z
CRIT

CVE-2026-71207 — Stock: An unauthenticated remote attacker can submit a payload such as ' OR '1'='1 in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71207

The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password values to $_SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can submit a payload such as ' OR '1'='1 in the login form to bypass authentication entirely. The same script additionally contains hardcoded administrative credentials (admin/neola) i CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDStockTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-05
2026-08-05 08:16Z
HIGH

CVE-2026-71206 — CheckToken: Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-71206

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or demoting it from owner to a regular role has no effect on tokens already issued to that account — a deleted or demoted owner's token continues authenticating with its original owner- CVSSv3.1 8.3 (HIGH)

CWECWE 613VNDChecktokenTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-08-05
2026-08-05 08:16Z
CRIT

CVE-2026-70376 — Pluck: CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70376

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function's elseif branch returns true, treating the request as same-origin. Because a cross-site attacker page can suppress the Referer header (e.g. via <meta name=referrer conte CVSSv3.1 9.6 (CRITICAL)

CWECWE 352VNDPluckTYPVulnerability
9.6
CVSS v3.1
98
Edit Score
2026-08-05
2026-08-05 08:16Z
HIGH

CVE-2026-6627 — WPFormify: The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6627

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`. The `admin_init` hook fires on `admin-post.php` which is accessible without authentication. This mak CVSSv3.1 8.2 (HIGH)

CWECWE 862VNDWpformifyTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-08-05
2026-08-05 08:16Z
HIGH

CVE-2026-6147 — LightSync: The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6147

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH)

CWECWE 434VNDLightsyncTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 08:16Z
HIGH

CVE-2026-64578 — Linux: A remote client can craft a compound request whose last element has exactly 64

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64578

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound (chained) SMB2 request, ksmbd_smb2_check_message() reads pdu->StructureSize2 without first checking that the compound element is large enough to contain it. StructureSize2 is a 2-byte field at offset 64 (__SMB2_HEADER_STRUCTURE_SIZE) from the start of each element. The compound-walking logic only guarantees CVSSv3.1 8.2 (HIGH) · EPSS 5th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-05
2026-08-05 08:16Z
CRIT

CVE-2026-64566 — Linux: This causes kernel-visible memory corruption and can trigger a panic.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64566

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() When iptfs_skb_add_frags() copies frag references from the source frag walk into a new SKB, it increments the page reference count via __skb_frag_ref() but does not propagate SKBFL_SHARED_FRAG to the destination SKB's skb_shinfo->flags. If the source SKB carries shared frags (e.g. from a page-pool backed receive path), the new inner SKB will CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-05
2026-08-05 08:16Z
CRIT

CVE-2026-61486 — UNSUPPORTED: ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-61486

** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. CVSSv3.1 9.8 (CRITICAL)

CWECWE 121VNDUnsupportedTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-05
2026-08-05 08:16Z
CRIT

CVE-2026-61484 — UNSUPPORTED: ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-61484

** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDUnsupportedTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-05
2026-08-05 08:16Z
CRIT

CVE-2026-5581 — Multi: The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5581

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the `GFMU_options` JavaScript object. This makes it poss CVSSv3.1 9.1 (CRITICAL)

CWECWE 862VNDMultiTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-05
2026-08-05 08:16Z
HIGH

CVE-2026-55997 — Rancher: issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55997

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster. CVSSv3.1 8.8 (HIGH)

CWECWE 312VNDRancherTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 08:16Z
HIGH

CVE-2026-55739 — Crater: isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-55739

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and $user->hasCompany($model->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers() method are similarly unscoped (self::find($id) with no company filter). Any authenticated user of one company can r CVSSv3.1 8.3 (HIGH)

CWECWE 639VNDCraterTYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2026-08-05
2026-08-05 08:16Z
HIGH

CVE-2026-54418 — Leantime: through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54418

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher). Any authenticated user can invoke getSetupData with an arbitrary userId to read that user's live TOTP secret, or disable2FA to strip another account's two-factor auth CVSSv3.1 8.1 (HIGH)

CWECWE 862VNDLeantimeTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-05
2026-08-05 08:16Z
CRIT

CVE-2026-4431 — Easy: The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4431

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. This is due to the `rbsm_submit_post` AJAX action being registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without any authorization checks when a `postId` parameter is supplied. This makes it possible for unauthenticated attackers to modify the ti CVSSv3.1 9.1 (CRITICAL)

CWECWE 862VNDEasyTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-05
2026-08-05 07:16Z
HIGH

CVE-2026-70375 — HashBrown: CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70375

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec(`git checkout ${this.branch || 'master'}`), interpolating the configured branch value directly into a shell command with no escaping. GitDeployer.validate() only rejects a single-quote character in the repo, branch, username, and password fields; shell metacharacters such CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDHashbrownTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 07:16Z
HIGH

CVE-2026-70374 — HashBrown: CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-70374

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail() in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec() ('convert ' + tempFile + ...). The MIME-type filter in getMIMEType() (src/Common/utilities.js) truncates the extracted extension at th CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDHashbrownTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 07:16Z
CRIT

CVE-2026-16940 — Custom: The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16940

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover. CVSSv3.1 10.0 (CRITICAL) · EPSS 6th percentile

CWECWE 22VNDCustomTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2026-08-05
2026-08-05 07:16Z
CRIT

CVE-2026-15360 — Ajax: The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15360

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database. CVSSv3.1 9.1 (CRITICAL)

CWECWE 89VNDAjaxTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-05
2026-08-05 07:16Z
HIGH

CVE-2026-15230 — YayPricing: The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15230

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes. CVSSv3.1 8.1 (HIGH)

CWECWE 284VNDYaypricingTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-05
2026-08-05 07:16Z
CRIT

CVE-2026-15210 — OTP: The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15210

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's. CVSSv3.1 9.1 (CRITICAL)

CWECWE 287VNDOtpTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-05
2026-08-05 07:16Z
HIGH

CVE-2026-14553 — WordPress: The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-14553

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user (Subscriber or higher) to upload arbitrary PHP files and achieve remote code execution. CVSSv3.1 8.1 (HIGH)

CWECWE 434VNDWordpressTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-05
2026-08-05 06:16Z
CRIT

CVE-2026-9273 — Membership: The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9273

The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, an CVSSv3.1 9.3 (CRITICAL)

CWECWE 640VNDMembershipTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-05
2026-08-05 06:16Z
HIGH

CVE-2026-8761 — Dokan: The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8761

The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `CustomersController` REST controller (`includes/REST/CustomersController.php`), which re-registers WooCommerce's customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce's native `manage_woocommerce` capability check with a vendor-only check that inspects the **requesting** user's CVSSv3.1 8.8 (HIGH)

CWECWE 862VNDDokanTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-05
2026-08-05 06:16Z
HIGH

CVE-2026-18322 — Smart: The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18322

The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` overwrites the popup module's administrator-restricted method list with the base controller's value, silently removing `save` from protected actions; this is compounded by the subscription confirmation email embedding the CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDSmartTYPVulnerability
8.8
CVSS v3.1
94
Edit Score