|
CVE-2026-97657
|
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
|
Tyche Softwares
|
Abandoned Cart Pro for WooCommerce
|
Critical
|
9.8
|
2026-10-14 02:27:39 |
Deep Dive
|
|
CVE-2026-102251
|
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter
|
Tyche Softwares
|
Abandoned Cart Pro for WooCommerce
|
High
|
7.5
|
2026-10-14 02:27:38 |
Deep Dive
|
|
CVE-2026-97668
|
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value
|
Tyche Softwares
|
Abandoned Cart Pro for WooCommerce
|
Critical
|
9.8
|
2026-10-14 02:27:38 |
Deep Dive
|
|
CVE-2026-110002
|
Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
|
snazzyplugins
|
Snazzy Social Media Feed
|
Critical
|
9.8
|
2026-10-14 02:27:37 |
Deep Dive
|
|
CVE-2026-82715
|
Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server
|
Hitachi
|
Hitachi Disk Array Driver for AIX
|
High
|
7.9
|
2026-10-14 01:46:59 |
Deep Dive
|
|
CVE-2026-86573
|
Out-of-bounds Write Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server
|
Hitachi
|
Hitachi Disk Array Driver for AIX
|
Medium
|
5.1
|
2026-10-14 01:46:58 |
Deep Dive
|
|
CVE-2026-86607
|
Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator
|
Hitachi
|
Hitachi Ops Center Administrator
|
Medium
|
4.3
|
2026-10-14 01:46:57 |
Deep Dive
|
|
CVE-2026-110392
|
Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning
|
Samsung Open Source
|
QA-Board
|
Critical
|
9.8
|
2026-10-14 01:35:36 |
Deep Dive
|
|
CVE-2026-92097
|
Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
|
holithemes
|
Click to Chat – HoliThemes
|
Critical
|
9.1
|
2026-10-14 01:27:16 |
Deep Dive
|
|
CVE-2026-17092
|
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
|
wpwax
|
Directorist: AI-Powered Business Directory, Listings & Classified Ads
|
High
|
8.1
|
2026-10-14 01:27:15 |
Deep Dive
|
|
CVE-2026-104767
|
Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
|
davefx
|
Membership & User Roles for WooCommerce (Automatic Role Changer)
|
High
|
7.5
|
2026-10-14 01:27:15 |
Deep Dive
|
|
CVE-2026-104995
|
BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
|
dontdream
|
BP Profile Search
|
High
|
8.1
|
2026-10-14 01:27:15 |
Deep Dive
|
|
CVE-2026-104749
|
Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data
|
bitpressadmin
|
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
|
High
|
7.5
|
2026-10-14 01:27:14 |
Deep Dive
|
|
CVE-2026-93388
|
Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
|
printcart
|
Printcart Store – Web to Print Product Designer for WooCommerce
|
Critical
|
9.8
|
2026-10-14 01:27:14 |
Deep Dive
|
|
CVE-2026-107652
|
Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
|
arshidkv12
|
Database Addon for Contact Form 7 – CFDB7
|
Medium
|
5.3
|
2026-10-14 01:27:14 |
Deep Dive
|
|
CVE-2026-103423
|
Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
|
masaakitanaka
|
Booking Package
|
High
|
7.5
|
2026-10-14 01:27:13 |
Deep Dive
|
|
CVE-2026-103425
|
Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
|
masaakitanaka
|
Booking Package
|
Medium
|
6.4
|
2026-10-14 01:27:13 |
Deep Dive
|
|
CVE-2026-110385
|
ONLYOFFICE Document Server <10.0.0 RCE漏洞
|
ONLYOFFICE
|
Document Server
|
High
|
8.7
|
2026-10-14 00:24:54 |
Deep Dive
|
|
CVE-2026-110359
|
Hyland Desktop Host 本地提权漏洞
|
Hyland
|
Desktop Host
|
High
|
7.8
|
2026-10-14 00:15:19 |
Deep Dive
|
|
CVE-2026-108473
|
Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices
|
TP-Link Systems Inc.
|
HS103 v5
|
High
|
8.7
|
2026-10-14 00:06:09 |
Deep Dive
|