PT-2026-79505

Name of the Vulnerable Software and Affected Versions AutomatorWP versions prior to 5.8.5 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated users with subscriber-level access or higher can...

CVE-2026-76074: Missing Authorization

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate and others executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios...

PT-2026-83619

We identified that proc-macro-en contained the same build script as proc-macro1 and it was part of the same supply chain attack. This crate had one single version published at 2026-08-20. The crate was removed from crates.io and related user account was locked. This crate was used as part of a...

The vulnerability of the Adobe Campaign Classic software platform, related to authentication errors, allows a perpetrator to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for managing marketing campaigns is related to authentication errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the Adobe Campaign Classic software platform for managing marketing campaigns stems from the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for managing marketing campaigns is related to the lack of security measures regarding the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization vulnerability

Subscriber+ Campaign Creation via Missing Authorization vulnerability discovered by Sajjad Haqi in WordPress Plugin WP Crowdfunding versions 2.2.1...

WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR vulnerability

Subscriber+ Campaign Update Modification via IDOR vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin WP Crowdfunding versions 2.2.1...

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit TRU, the backdoor is a compiled C/C++ implant delivered ...

Dissecting the JWR phishing framework

Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. The client engine of the JWR phishing framework is a real-time, operator-driven...

Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362...

vulnerabilities in Adobe Campaign Classic

Adobe has identified vulnerabilities in Adobe Campaign Classic. These vulnerabilities allow attackers to execute arbitrary code without user interaction. One of the vulnerabilities involves incorrect authorization, allowing attackers to perform actions beyond the intended permissions. Another...

CVE-2026-14859 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14859 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

EUVD-2026-57078

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-14857

The WP Crowdfunding WordPress plugin versions prior to 2.2.1 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify campaign ownership, allowing any authenticated user—including those with the Subscriber role—to modify the update history of campaigns belongin...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-14859: Improper Access Control

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...