-
A 9.8 upload flaw in a plugin on 60,000 WordPress sites, and neither published changelog says which release fixed it
CVE-2026-82901, an unauthenticated arbitrary file upload in the Ultra Addons for Contact Form 7 plugin scored 9.8 critical, reached NVD on Saturday, September 26, 2026, at 2:16 p.m.…
-
The WordPress core flaw is on CISA’s catalog with a Monday deadline, scored by the 8.1 CISA supplied itself
CVE-2026-87902, the WordPress core file-inclusion flaw patched in 7.1.2, was added to CISA’s Known Exploited Vulnerabilities catalog on Friday, September 25, 2026, with a federal remediation deadline of…
-
A low-privileged Kibana user can make a shared AI agent act as an administrator, and Elastic’s mitigation switches off a different feature
Elastic has fixed a confused-deputy flaw in Kibana’s Agent Builder that lets a non-administrative user who can edit a shared AI agent have privileged operations carried out under…
-
CISA adds a third exploited RouterOS flaw to its catalog, and the one CERT Polska calls half the attack chain still is not on it
CVE-2026-67279, a pre-authentication SSH flaw in MikroTik RouterOS scored medium by both NVD and CERT Polska, went into CISA’s Known Exploited Vulnerabilities catalog on Friday, September 25, 2026,…
-
Microsoft’s SharePoint record says “exploited: No” in the same revision that reports observed attacks
CVE-2026-65660, a SharePoint code-injection flaw Microsoft patched on August 11, 2026, went into CISA’s Known Exploited Vulnerabilities catalog on Friday, September 25, 2026, with a federal remediation deadline…
-
A percent-encoded slash gets a Kyverno tenant cluster admin, and the project’s own advisory for it still says “No known CVE”
VulnCheck published CVE-2026-100706 this morning at 9.9 critical for a flaw Kyverno fixed on September 10 — and the project’s own advisory for the same flaw still records…
-
miniOrange’s OTP plugin accepts an empty password as proof of administrator, for the second time in eleven weeks
CVE-2026-85984, published this afternoon at 9.8 critical, lets an unauthenticated attacker log in as any administrator with a known username and an empty password — and the plugin…
-
Flowise’s SSO path validates the server’s own invitation token, and the repository was archived six weeks before the CVEs arrived
Six CVEs published this morning against Flowise 3.1.4 and earlier include an authentication bypass scoring 9.2 critical on CVSS v4, and the project archived its repository on August…
-
Addify’s WooCommerce quote plugin has a 9.8 unauthenticated PHP upload, a public exploit script, and no release above the affected 2.9.2
Wordfence published a 9.8 unauthenticated file upload in Addify’s Request a Quote for WooCommerce this morning; the WooCommerce marketplace still lists 2.9.2 — the top of the affected…
-
LiteLLM CVE-2026-89032 is marked fixed in a release candidate, and the change in it defaults to the sharing behavior it is meant to stop
The record says the LiteLLM semantic cache flaw is fixed in 1.101.0-rc.1; the change that shipped in 1.101.0-rc.1 is a configuration option whose default is the sharing behavior…
-
Cloudflare’s container disks returned unzeroed blocks to a shared pool, and the researcher pulled 2,700 foreign inodes out of them
Cloudflare’s own postmortem says a researcher recovered filesystem metadata belonging to other customers from recycled container storage, and the only record of the flaw is the blog post.…
-
X-SpringBoot’s seed database turns every login code into 172839, and the code endpoint returns it anyway
Two of the four X-SpringBoot flaws VulnCheck published Friday evening are each independently sufficient for account takeover, and fixing either one leaves the other standing. What happened VulnCheck,…
-
LemonLDAP::NG’s 9.1 reads token metadata, and the flaw in the same function that mints tokens has no score at all
Two of the three LemonLDAP::NG flaws disclosed this morning come out of the same unverified client secret; the one scored 9.1 critical reads token metadata, and the one…