PT-2026-69984

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.6.0-beta.1 through 4.6.3 Mastodon version 4.7.0-beta.1 Description An incorrect access control validation in the show action within app/controllers/admin/collections controller.rb allows any logged-in local user to access...

PT-2026-69955

Name of the Vulnerable Software and Affected Versions Data Science Pipelines Operator affected versions not specified Description Data Science Pipelines Operator DSPO contains a flaw where its ClusterRole grants excessive privileges beyond what is required for its operation. These permissions...

PT-2026-69992

Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description Insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. This flaw enables an attacker to perform administrative actions...

PT-2026-69328

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Doctors Appointment System version 1.0 Description A SQL injection flaw exists that allows remote attackers to manipulate the ID argument. This issue occurs within an unknown function in the '/admin/ajax.php?action=set...

CVE-2026-19343

A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-19343 code-projects Task Management System AdminLogin.php sql injection

A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit...

EUVD-2026-54912

A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-16032

The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

EUVD-2026-54883

The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038 InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-16032 LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring

The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an...

CVE-2026-16032 LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring

The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an...

CVE-2026-16032

The CVE-2026-16032 affects the LWS Optimize WordPress plugin (pre-4.1.2). The root cause is improper escaping of a value submitted via an unauthenticated analytics endpoint, which is stored and later rendered in an administrative dashboard. This enables unauthenticated attackers to inject arbitra...

CVE-2026-16032

The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an...

PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response

The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor whose plugins are available in the official WordPress plugins directory. Currently, all the affected plugins are temporarily closed pending a full...

CVE-2026-16578

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability CVSS score: 10.0, which does not carry a CVE identifier, allows an unauthenticated remote attacker ...

N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management RMM product. "We are proactively expanding protections in response to ongoing monitoring of threat actor...