-
PingCAP Breach Exposes Customer Records and Source Code
PingCAP recently confirmed unauthorized access to its internal systems and the theft of source code and customer-related data. The …
-
CVE-2026-94295 – The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not …
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually …
-
CVE-2026-116044 – A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. …
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality …
-
CVE-2026-115251 – The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade …
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator …
-
CVE-2026-115214 – The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the …
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it …
-
CVE-2026-115183 – The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a …
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget’s heading text after decoding HTML entities …
-
CVE-2026-114743 – The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check …
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before …
-
CVE-2026-114742 – The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks …
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with …
-
CVE-2026-114741 – The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization …
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, …
-
CVE-2026-114740 – The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when …
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing …
-
CVE-2026-111981 – The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when …
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who …
●●●
NVD
- CVE-2026-115999 – A vulnerability has been found in mansi-k Restaurant_IMS …
- CVE-2026-94295 – The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not …
- CVE-2026-116000 – A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability …
- CVE-2026-115997 – A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function …
- CVE-2026-116004 – A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is …
EXPLOITS
- PHP2Shell (CVE-2026-109618) – PHP core versions after v5.4 – RCE
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asi
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Operation FlashHole: Lazarus breaks security, defies control
- The journey of a paper unicorn: adventures inside a modern warehouse
- MacSync under the microscope: new delivery methods and a new payload