CVE-2026-84301

The open-source LLM platform FastGPT is vulnerable to a DNS rebinding attack in versions prior to 4.15.2 . The root cause is a time-of-check/time-of-use (TOCTOU) flaw in the safe Axios request interceptor located in packages/service/common/api/axios.ts. The system validates a hostname using isInt...

CVE-2026-76802

The Nuclei vulnerability scanner (versions 3.0.0 through 3.10.0 ) contains a flaw in its DAST template loading branch. When the -dast flag is enabled, the loader fails to enforce cryptographic signature checks on templates containing both a fuzzing: block and an unsigned code: block. This allows ...

SUSE CVE-2026-92495

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap bnxtremmap rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still retain VMMAYWRITE. nd later be upgraded with mprotectPROTWRITE. This ca...

SUSE CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-93616

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

CVE-2026-93616 Directory Traversal and File upload allows execution of arbitrary script on the Management Server

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

EUVD-2026-84375

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

CVE-2026-93616 Directory Traversal and File upload allows execution of arbitrary script on the Management Server

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

CVE-2026-93616

A pre-authentication directory traversal vulnerability exists in the Check Point Management Web Service , affecting Check Point Security Management and Log Servers. This flaw allows unauthenticated attackers to upload and execute arbitrary scripts, potentially leading to remote code execution . A...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-85102link is external Check Point Multiple Products Improper Certificate Validation Vulnerability CVE-2026-93616link is external Check Point Multiple...

CVE-2026-18345

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-18345 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

EUVD-2026-84307

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-12470 CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

EUVD-2026-84273

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

CVE-2026-12470

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes for WordPress (all versions up to and including 4.1.17 ) is affected by a missing capability check on the cmp_ajax_import_settings AJAX action. An authenticated attacker with Editor-level or higher access can update arbitrary site options,...

PT-2026-96710

Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8 Description A flaw in the Hash Comparison component allows for a remote attack. The check password function within the changedetectionio/flask app.py file is susceptible to manipulation of t...

CVE-2026-12470: Improper Privilege Management

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

PT-2026-96646

Name of the Vulnerable Software and Affected Versions CMP – Coming Soon & Maintenance Plugin by NiteoThemes versions prior to 4.1.18 Description An issue exists where a missing capability check on the 'cmp ajax import settings' AJAX action allows authenticated attackers with Editor-level access o...