EUVD-2026-84375

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-85102link is external Check Point Multiple Products Improper Certificate Validation Vulnerability CVE-2026-93616link is external Check Point Multiple...

CVE-2026-18345

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-18345 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

EUVD-2026-84307

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-12470 CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

EUVD-2026-84273

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

CVE-2026-12470

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes for WordPress (all versions up to and including 4.1.17 ) is affected by a missing capability check on the cmp_ajax_import_settings AJAX action. An authenticated attacker with Editor-level or higher access can update arbitrary site options,...

PT-2026-96710

Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8 Description A flaw in the Hash Comparison component allows for a remote attack. The check password function within the changedetectionio/flask app.py file is susceptible to manipulation of t...

PT-2026-96646

Name of the Vulnerable Software and Affected Versions CMP – Coming Soon & Maintenance Plugin by NiteoThemes versions prior to 4.1.18 Description An issue exists where a missing capability check on the 'cmp ajax import settings' AJAX action allows authenticated attackers with Editor-level access o...

PT-2026-96856

Name of the Vulnerable Software and Affected Versions Tauri affected versions not specified Description The updater plugin contains a flaw where the 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When this parameter is set to true, the...

PT-2026-96833

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description The DAST template loading branch fails to apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When the...

PT-2026-96668

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.2.2 Description Authenticated users with Subscriber-level access and above can deactivate the plugin by sending a crafted POST request to the 'admin-ajax' endpoint. This occurs because the send deactivation surve...

ROS-20260922-73-0036

The vulnerability of the msmiommumap function in the drivers/gpu/drm/msm/msmiommu.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to incorrect checking of the returned value from this function. Exploiting this vulnerability could allow an attacker...

VulnCheck KEV: CVE-2026-85102

Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway...

VulnCheck KEV: CVE-2026-93616

Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts...

CVE-2026-12470: Improper Privilege Management

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

CVE-2026-95624: Improper Access Control

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

Check Point Security Management R82.20 Compromise Checks

These shell scripts check Check Point Security Management logs and temporary directories for indicators associated with CVE-2026-93616...

Oracle Linux 9 : gstreamer1-plugins-base (ELSA-2026-69100)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69100 advisory. - Fix CVE-2026-18297: opusdec channel position bounds check Resolves: RHEL-246587 - Fix crash in RTSP auth credential parsing CVE-2026-85150 Resolves:...