-
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in …
-
Three insights you may have missed from theCUBE’s coverage of Okta’s Oktane event
AI agent governance is moving identity security into the flow of work. As agents call tools, delegate tasks and act across applications, …
-
CVE-2026-97353 – The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform …
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post …
-
CVE-2026-97352 – The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a …
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing …
-
CVE-2026-87835 – The Front End Users WordPress plugin through 3.2.35 does not restrict which account …
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through …
-
CVE-2026-114429 – The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its …
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and …
-
CVE-2026-113674 – The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of …
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before …
-
CVE-2026-113673 – The GeoDirectory WordPress plugin before 2.8.194 does not properly escape …
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated …
-
CVE-2026-113493 – The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of …
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them …
-
CVE-2026-113492 – The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or …
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of …
-
CVE-2026-113491 – The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image …
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when …
-
CVE-2026-113490 – The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or …
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing’s map-popup …
●●●
NVD
- CVE-2026-115807 – The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role …
- CVE-2026-105199 – The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a …
- CVE-2026-115929 – MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root …
- CVE-2026-97353 – The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform …
- CVE-2026-115806 – The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object …
EXPLOITS
- PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asi
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Operation FlashHole: Lazarus breaks security, defies control
- The journey of a paper unicorn: adventures inside a modern warehouse
- MacSync under the microscope: new delivery methods and a new payload