Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,055 alerts · page 30 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-78189 WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback

    CriticalCVSS 9.8 EPSS 0.61%

    Exploit status: No public exploit known

    Affects: cpan WebDyne

    WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the reques...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-103882 Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter

    CriticalCVSS 9.1 EPSS 0.79%

    Exploit status: No public exploit known

    Affects: Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress, wordpress acadlix

    The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This ma...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-118235 SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data

    CriticalCVSS 9.8 EPSS 0.74%

    Exploit status: No public exploit known

    Affects: wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications, wordpress simple-form

    The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-116512 Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection

    CriticalCVSS 9.8 EPSS 0.58%

    Exploit status: No public exploit known

    Affects: wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker, wordpress wedevs-project-manager

    The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter va...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-119096 Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

    CriticalCVSS 9.8 EPSS 0.46%

    Exploit status: No public exploit known

    Affects: uncannyowl Uncanny Toolkit for LearnDash, wordpress uncanny-learndash-toolkit

    The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uo_login_action() function. This is due to a parser-differential flaw in which the plugin's account-verification ga...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-116557 WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

    CriticalCVSS 9.1 EPSS 0.35%

    Exploit status: No public exploit known

    Affects: murgroland WP Booking System – Booking Calendar, wordpress wp-booking-system

    The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenti...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-109220 PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field

    CriticalCVSS 9.8 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: wordpress pdf-for-woocommerce, addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder

    The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note check...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-89270 Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters

    CriticalCVSS 9.1 EPSS 0.39%

    Exploit status: No public exploit known

    Affects: wordpress popup-builder, popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups.

    The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action....

  9. CISA KEV addition Published · updated

    CVE-2026-119977 WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    HighCVSS 8.1 EPSS 1.2% CISA KEV added 2026-11-03 · due 2026-11-06 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: debian/wordpress, WordPress

    WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgr...

  10. Critical (CVSS 9+) Published · updated

    WORDFENCE-cc49112a-4f12-4fc3-8f9b-832f657d76ec Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: wordpress contact-form-7

    The Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload in versions 6.2 through 6.2.3. This is due to missing file type validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-117656 Unverified Sign in with Apple callback parameter can override verified ID token claims

    CriticalCVSS 9.3 EPSS 0.23%

    Exploit status: No public exploit known

    Affects: pow-auth assent

    Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-63377 TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover

    CriticalCVSS 9.8 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: fctr-id okta-ai-agent

    TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, POST /api/auth/setup in src/api/routers/auth.py allows an unauthenticated network attacker to create the first administrator account befo...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-62863 MoLing: unauthenticated SSE and wildcard CORS expose tool sessions

    CriticalCVSS 9.6 EPSS 0.31%

    Exploit status: No public exploit known

    Affects: gojue moling

    MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using -l, its /sse and /message HTTP endpoints do not authenticate requests and the mcp-go dependency sets Access-Control-Allow-Origin: *. A malicious web page can open a cross...

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-62849 ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

    CriticalCVSS 9.1 EPSS 0.50%

    Exploit status: No public exploit known

    Affects: mqttsnet thinglinks

    ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote una...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-62853 ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

    CriticalCVSS 9.9 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: mqttsnet thinglinks

    ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed Groovy compilation and loading flow. An authenticated attacker can provide code that is compiled and...

  16. Critical (CVSS 9+) Published

    GHSA-5xjx-3w67-w9x9 pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: pypa/gh-action-pypi-publish

    Summary The pypi-publish action versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. Details The certifi-provided TLS trust stor...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

    CriticalCVSS 9.1 EPSS 0.19%

    Exploit status: No public exploit known

    Affects: deadtrickster ssl verify fun, debian/rebar3

    Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors onl...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-61620 HoneySQL unchecked entity names can lead to SQL injection results

    CriticalCVSS 9.8 EPSS 0.39%

    Exploit status: No public exploit known

    Affects: seancorfield honeysql

    HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL DSL by calling keyword or symbol on that input can produce SQL strings that facilitate SQL injection when executed unchanged by...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-116241 pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier

    CriticalCVSS 9.4 EPSS 0.31%

    Exploit status: No public exploit known

    Affects: pgadmin.org pgAdmin 4, pgadmin 4

    pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quot...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-116238 pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks

    CriticalCVSS 9.2 EPSS 0.42%

    Exploit status: No public exploit known

    Affects: pgadmin.org pgAdmin 4, pgadmin 4

    In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the de...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).