WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.9.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by daroo in WordPress Plugin Bit Integrations versions = 2.9.0...

CVE-2026-15006

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

CVE-2026-15006

The Bit integrations plugin for WordPress (Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation) is affected by a Directory Traversal vulnerability in the processAttachment function, impacting all versions up to 2.9.0. This allows unauthenticated attackers to read arbitrary server...

CVE-2026-15006: Improper Limitation of a Pathname to a Restricted Directory

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

libretto v0.6.39

Libretto Libretto is a toolkit for building robust web integrations. It gives your coding agent a live browser and a token-efficient CLI to: Inspect live pages with minimal context overhead Capture network traffic to reverse-engineer site APIs Record user actions and replay them as automation...

hate_crack v2.16.0

root@kitploit: / | \ / | \ \ | | / \ \ / \ / \ /\ \ \ / | |/ / \ Y // | | \ / \ | | // \ | \ /|| /\ | \ / / // / / / / Installation Installing from source is the only supported path. hatecrack is not distributed on PyPI: pip install hate-crack resolves to a 0.0.0 placeholder that...

awesome-wazuh — Updated!

awesome-wazuh Curated list of Wazuh resources, tools, and integrations Wazuh is a free, open-source security monitoring platform for threat prevention, detection, and response. Contents Official Documentation Getting Started Setup Guides Deployment Docker Kubernetes Terraform / OpenTofu Ansible...

300 WINtegrations Strong: An Open Security Ecosystem Built for the Speed of AI

As AI accelerates how organizations build and how attackers operate, a deeply connected security ecosystem is how defenders keep up...

CVE-2026-13694

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations...

CVE-2026-13694 Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations...

CVE-2026-13694

The Bit Form WordPress plugin versions before 3.1.0 is vulnerable to an authentication bypass due to insufficient validation of the workflow-trigger token after its associated transient has expired. This flaw allows unauthenticated attackers to re-trigger configured workflow actions, such as send...

EUVD-2026-46161

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations...

CVE-2026-13694: Missing Authorization

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations...

CVE-2026-63428 HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, completeSubmission accepts a hiddenFields: id, name, value array from the submitter and stores it verbatim in submission.hiddenFields, without validating the supplied id/name against the form's declared form.hiddenFields schema...

[Video] Where protection starts: Cisco Talos Intelligence Integrations

!\Video\ Where protection starts: Cisco Talos Intelligence Integrationshttps://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/07/Talosintegrationsheader-2.jpg Cybersecurity has always involved elements of uncertainty. Every day, security teams are asked to make...

Defending SaaS-based applications against ShinyHunters OAuth abuse

In this article 1. Attack chain overview 2. Improving visibility into Salesforce OAuth abuse 3. Mitigation and protection guidance 4. Learn more In a series of campaigns observed between mid-2025 and mid-2026, Microsoft identified threat actor activity with overlapping tradecraft commonly...

Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

SummaryThe DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

CVE-2026-46700

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...

EUVD-2026-42080

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...