Real-time aggregated intelligence from trusted cybersecurity & AI sources. Discuss, react and stay ahead of threats.
CVE ID :CVE-2026-45695 Published : July 16, 2026, 3:42 p.m. | 34 minutes ago Description :Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side…
CVE ID :CVE-2026-55440 Published : July 16, 2026, 3:35 p.m. | 41 minutes ago Description :Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py called get_or_create_session in ufo/server/services/session_manager.py without owner_client_id, allowing an authenticated client to create an unowned attacker-chosen session_id such as constellation_task_id = f"{task_name}@{task_id}" and deny th
CVE ID :CVE-2026-63082 Published : July 16, 2026, 3:35 p.m. | 41 minutes ago Description :Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket to which they ar
CVE ID :CVE-2026-63081 Published : July 16, 2026, 3:33 p.m. | 43 minutes ago Description :Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-level privileges to inject malicious payloads into the Notes field of assigned support tickets. Attackers can store malicious scripts that execute in the browser context of any user who views the affected ticket notes, including Superadmin use
CVE ID :CVE-2026-12379 Published : July 16, 2026, 3:32 p.m. | 44 minutes ago Description :An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted external site after authenticating against the genuine Dashboard. Because the link points at the legitimate Da
CVE ID :CVE-2026-54568 Published : July 16, 2026, 3:32 p.m. | 45 minutes ago Description :Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellatio
CVE ID :CVE-2026-57206 Published : July 16, 2026, 3:17 p.m. | 1 hour ago Description :SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/single_app/plugin_validation_endpoint.py, including `POST /api/admin/plugins/test-instantiation`, `GET /api/admin/plugins/health-check/ `, `POST /api/admin/plugins/repair/ `, and `POST /api/plugins/validate`, relied on @swag
CVE ID :CVE-2026-59863 Published : July 16, 2026, 3:16 p.m. | 1 hour ago Description :Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal
CVE ID :CVE-2026-59862 Published : July 16, 2026, 3:16 p.m. | 1 hour ago Description :Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attac
CVE ID :CVE-2026-59861 Published : July 16, 2026, 3:16 p.m. | 1 hour ago Description :Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary
CVE ID :CVE-2026-59860 Published : July 16, 2026, 3:16 p.m. | 1 hour ago Description :Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator charact
CVE ID :CVE-2026-59859 Published : July 16, 2026, 3:16 p.m. | 1 hour ago Description :Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code
CVE ID :CVE-2026-59237 Published : July 16, 2026, 3:16 p.m. | 1 hour ago Description :Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company (tenant) via a sequential numeric {id} supplied to GET /api/order/{id}, PUT /api/order/{id}, GET /api/order-item/{id}, PUT /api/order-item/{id}, or
CVE ID :CVE-2026-14254 Published : July 16, 2026, 3:16 p.m. | 1 hour ago Description :A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force protections and enabling continued password guessing against a targeted account. Severity: 8.3 | HIGH Visit the link for mo
CVE ID :CVE-2026-57205 Published : July 16, 2026, 3:12 p.m. | 1 hour, 4 minutes ago Description :SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/ and GET /api/user/profile-image/ endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allow
CVE ID :CVE-2026-6424 Published : July 16, 2026, 8:28 a.m. | 30 minutes ago Description :Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system Severity: 6.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15324 Published : July 16, 2026, 8:26 a.m. | 32 minutes ago Description :The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'row_type' parameter in all versions up to, and including, 4.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in p
CVE ID :CVE-2026-15103 Published : July 16, 2026, 8:26 a.m. | 32 minutes ago Description :The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` an
CVE ID :CVE-2026-15727 Published : July 16, 2026, 8:26 a.m. | 32 minutes ago Description :The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries
CVE ID :CVE-2026-15021 Published : July 16, 2026, 8:26 a.m. | 32 minutes ago Description :The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE ID :CVE-2026-15005 Published : July 16, 2026, 8:26 a.m. | 32 minutes ago Description :The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, which bypasses path valid
CVE ID :CVE-2026-13741 Published : July 16, 2026, 8:26 a.m. | 32 minutes ago Description :The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator by su
CVE ID :CVE-2026-58078 Published : July 16, 2026, 8:14 a.m. | 44 minutes ago Description :The Joomla extension Quix Page Builder Pro is vulnerable to an unauthenticated SQL injection. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-6423 Published : July 16, 2026, 7:56 a.m. | 1 hour, 2 minutes ago Description :A local privilege escalation vulnerability in ESET Inspect Connector. The vulnerability was caused by improper authentication in an IPC channel. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-13755 Published : July 16, 2026, 7:51 a.m. | 1 hour, 7 minutes ago Description :The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute in all versions up to, and including, 3.6.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
CVE ID :CVE-2026-15610 Published : July 16, 2026, 7:51 a.m. | 1 hour, 7 minutes ago Description :The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger arbitrary re-embedding of sto
CVE ID :CVE-2026-15106 Published : July 16, 2026, 7:51 a.m. | 1 hour, 7 minutes ago Description :The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversa
CVE ID :CVE-2026-15407 Published : July 16, 2026, 7:51 a.m. | 1 hour, 7 minutes ago Description :The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite or delete the generated CSS stylesheet file of arbitrary posts, including pri
CVE ID :CVE-2026-15651 Published : July 16, 2026, 7:51 a.m. | 1 hour, 7 minutes ago Description :The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' parameter in all versions up to, and including, 14.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additio
CVE ID :CVE-2026-15008 Published : July 16, 2026, 7:51 a.m. | 1 hour, 7 minutes ago Description :The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function in all versions up to, and including, 7.3.1.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code executio
CVE ID :CVE-2026-53366 Published : July 16, 2026, 6:16 a.m. | 42 minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb are copied into th
CVE ID :CVE-2026-12979 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service). Severity: 0.0 | NA Visit the link for more de
CVE ID :CVE-2026-12978 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active. Severity: 0.0 | NA Visit the link for mo
CVE ID :CVE-2026-12907 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators. Severity: 0.0 | NA Visit the link for more details, such as CVSS details
CVE ID :CVE-2026-12906 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more.
CVE ID :CVE-2026-12869 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site. Severity: 0.0
CVE ID :CVE-2026-12684 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk s
CVE ID :CVE-2026-12585 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account, allowing unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and
CVE ID :CVE-2026-12525 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile, on sites where the Redux Framework WordPress plugin before 4.5.13's user-profile (Users extension) feature is enab
CVE ID :CVE-2026-12510 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timel
CVE ID :CVE-2026-12492 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected produc
CVE ID :CVE-2026-12395 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-11866 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator. Severity: 0.0 | NA Visit the
CVE ID :CVE-2026-11371 Published : July 16, 2026, 6 a.m. | 58 minutes ago Description :The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browser of any visitor who views the affected page, including administrators. Severity: 0.0 | NA Visit the link for more d
CVE ID :CVE-2026-15925 Published : July 16, 2026, 5:31 a.m. | 1 hour, 27 minutes ago Description :Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain,
CVE ID :CVE-2026-21729 Published : July 16, 2026, 4:17 a.m. | 38 minutes ago Description :Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15652 Published : July 16, 2026, 4:17 a.m. | 38 minutes ago Description :The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribute in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
CVE ID :CVE-2026-15336 Published : July 16, 2026, 4:17 a.m. | 38 minutes ago Description :The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes_demo_import_activate_plugin() function, hooked on admin_init when the activate_plugin GET parameter is present, calling Plugin_Upgrader::install() to download and install a plugin from WordPress.org before performing the current_user_can('activate_pl
CVE ID :CVE-2026-14987 Published : July 16, 2026, 4:17 a.m. | 38 minutes ago Description :The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that
CVE ID :CVE-2026-13005 Published : July 16, 2026, 4:17 a.m. | 38 minutes ago Description :The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute wh