Atlassian Data Center Products Arbitrary File Access

Atlassian Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center versions prior to the listed fixes contain an unauthenticated arbitrary file access vulnerability...

PT-2026-122580

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122575

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122582

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122583

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122577

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122570

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122576

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122578

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122504

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limit...

PT-2026-122507

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remot...

PT-2026-122579

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122584

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122586

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

VulnCheck KEV: CVE-2024-8517

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request...

PT-2026-122571

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122603

When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and...

PT-2026-122587

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

PT-2026-122581

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked. Here's the deal...

Gitea 1.27.0 Arbitrary File Read

Gitea version 1.27.0 and prior affected versions contain an arbitrary file read through Org-mode +INCLUDE directives submitted to a public repository markup endpoint. The proof of concept retrieves target files and attempts a chain to command execution. https://packetstorm.news/download/237363...