Vulnerabilities
Cyber Security News Ranks 2027 Website Builders by Security and Patch Management
Cyber Security News argues that hosted website builders offer superior security by absorbing patching and server hardening duties from site owners.
Threat Times Exposure Desk
Vulnerabilities
XRP Protocol Vulnerability Could Have Enabled Unauthorized Crypto Creation
A bug in the XRP ledger allowed potential inflation of tokens, highlighting rising risks in crypto infrastructure security.
Vulnerabilities
CISA Adds ProFTPD, Strapi, Apache Struts Flaws to Known Exploited Vulnerabilities Catalog
The US CISA has added five new vulnerabilities to its KEV catalog, including flaws in ProFTPD, ONLYOFFICE Docs, and Apache Struts.
Vulnerabilities
Horizon3.ai Discovers Actively Exploited Zammad Vulnerability CVE-2026-102489
Research from Horizon3.ai reveals a critical flaw in Zammad that attackers are using to hijack user sessions via WebSocket errors.
Vulnerabilities
Wordfence Releases Weekly WordPress Vulnerability Report for Late September 2026
Wordfence Intelligence published its weekly vulnerability digest covering disclosures from September 28 through October 4, 2026, for WordPress administrators.
Vulnerabilities
BotSharp 5.2.0 has critical auth bypass via hardcoded JWT key
An unauthenticated remote attacker can forge bearer tokens in BotSharp through version 5.2.0 using a hardcoded secret in the WebStarter configuration file.
Vulnerabilities
Agnaistic agnai 1.0.555 Vulnerable to Critical Hardcoded Credential Flaw
A critical vulnerability in Agnaistic agnai allows unauthenticated attackers to gain admin access via hardcoded credentials and JWT secrets.
Vulnerabilities
TOZED X300 Firmware Faces Unpatched Critical Remote Code Execution Flaw CVE-2026-108576
A critical OS command injection vulnerability in TOZED X300 firmware allows remote attackers to execute arbitrary commands without authentication.
Vulnerabilities
IBM and Red Hat’s Lightwell Project Identifies 400 Java Library Vulnerabilities
The open-source security initiative has found over 400 undiscovered flaws in Java libraries and launched a clearinghouse for customer code review.
Vulnerabilities
FortiBleed Remains Active as Help Net Security Reviews Recent Security News
Help Net Security reports that the FortiBleed vulnerability remains active while highlighting a healthcare fintech security interview.
Vulnerabilities
Remote code execution flaw in OpenSpug Spug rated critical by NVD
The National Vulnerability Database has assigned a 9.4 score to CVE-2026-108540, a command injection vulnerability in OpenSpug Spug that allows remote attackers to execute arbitrary operating system commands.
Vulnerabilities
Wukong_HRM Authentication Bypass Grants Admin Access Without Token
A critical flaw in Wukong_HRM allows unauthenticated attackers to bypass security controls and manipulate sensitive HR data.
Vulnerabilities
Critical SQL Injection Flaw Found in ELEX WooCommerce Plugin Versions 1.5.3 and Below
The National Vulnerability Database rates CVE-2026-40800 as critical, affecting the ELEX WooCommerce Advanced Bulk Edit Products plugin.
Vulnerabilities
Critical Unauthenticated File Upload Flaw Found in Tailored Tools Versions Up to 3.0.3
A new critical vulnerability in Tailored Tools allows unauthenticated arbitrary file uploads, risking full system compromise for sites running version 3.0.3 or earlier.
Vulnerabilities
Critical Unauthenticated SQL Injection Found in Stylemix uListing Plugin
The National Vulnerability Database rates CVE-2026-62031 as critical, affecting uListing versions up to 2.2.0 with unauthenticated SQL injection flaws.
Vulnerabilities
Critical Privilege Escalation Flaw Found in Sergey AIWU Versions Up to 1.5.9
The National Vulnerability Database lists CVE-2026-39801 as a critical severity issue allowing subscriber privilege escalation in AIWU software.
Vulnerabilities
Unauthenticated RCE Vulnerability Found in SiteVault WordPress Plugin Versions Up to 1.5.19
The National Vulnerability Database lists a critical flaw in Royal Plugins SiteVault that allows attackers to execute code without authentication.
Vulnerabilities
Critical Unauthenticated PHP Injection Flaw Found in Payever WooCommerce Plugin
The NVD rates CVE-2026-42716 as critical with a 9.8 score, affecting Payever WooCommerce Gateway versions up to 4.8.2 through unauthenticated object injection.
Vulnerabilities
Critical PHP Object Injection Flaw Found in Dynamic User Directory Plugin
A CVSS 9.8 vulnerability in the Dynamic User Directory plugin allows remote attackers to inject PHP objects in versions up to 2.4.
Vulnerabilities
Unauthenticated PHP Object Injection Flaw in Booster for WooCommerce Rated Critical
A critical vulnerability in Booster for WooCommerce allows unauthenticated attackers to inject PHP objects, earning a CVSS score of 9.8.
Vulnerabilities
Unauthenticated PHP Object Injection Flaw Found in CleanSkin Plugin
A critical vulnerability in the CleanSkin WordPress plugin allows attackers to inject malicious code without logging in.
Vulnerabilities
Tonda Membership Plugin Has Critical Unauthenticated Privilege Escalation Flaw
The National Vulnerability Database rates CVE-2026-62022 as critical due to an unauthenticated privilege escalation issue in versions up to 1.0.1.
Vulnerabilities
Critical Arbitrary File Upload Flaw Found in CodeBard Help Desk Plugin
The National Vulnerability Database rates CVE-2026-62024 as critical, affecting CodeBard Help Desk versions up to 1.1.2 with unrestricted file upload risks.
Vulnerabilities
DirectoryPress Plugin Vulnerable to Critical Unauthenticated File Inclusion
A critical flaw in DirectoryPress versions up to 3.6.27 allows unauthenticated local file inclusion, rated CVSS 9.8 by the NVD.