CVE-2025-15079

creationtimestamp| type| source ---|---|--- 2026-01-07 06:48:21+00:00| seen| https://seclists.org/oss-sec/2026/q1/35 2026-01-07 07:51:28+00:00| seen| https://infosec.exchange/users/harrysintonen/statuses/115852724607348302 2026-01-07 08:21:38+00:00| seen|...

EUVD-2026-1274

The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the security check only...

CVE-2025-15471

creationtimestamp| type| source ---|---|--- 2026-01-06 21:54:39+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115850377807051367 2026-01-07 02:04:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbsev2vuft2u 2026-01-07 03:01:30+00:00| seen|...

GHSA-GG4X-FGG2-H9W9

creationtimestamp| type| source ---|---|--- 2026-01-06 19:51:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849892053733021 2026-01-24 21:30:31+00:00| seen| https://gist.github.com/alon710/ecdbc01c3c96ce665a77ba8b31b2fc40 2026-01-24 21:30:33+00:00| seen|...

EUVD-2026-0952

Missing Authorization vulnerability in Fahad Mahmood RSS Feed Widget rss-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RSS Feed Widget: from n/a through = 3.0.2...

EUVD-2026-1014

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e-plugins JobBank allows Reflected XSS.This issue affects JobBank: from n/a through 1.2.2...

CVE-2020-36916

creationtimestamp| type| source ---|---|--- 2026-01-06 16:10:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849026353201544 2026-01-06 17:28:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbri2npaq62g 2026-01-07 21:03:10+00:00| seen|...

CVE-2020-36920

creationtimestamp| type| source ---|---|--- 2026-01-06 16:10:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115849026353201544 2026-01-06 17:23:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbrhrp7hkx22 2026-01-07 21:03:12+00:00| seen|...

EUVD-2026-1030

Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger a 5-minute service disruption...

How to Avoid Phishing Incidents in 2026: A CISO Guide

Phishing in 2026 is harder to detect and verify. Learn how CISOs can speed up investigations, reduce noise, and respond with confidence...

EUVD-2026-1061

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘islinking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

EUVD-2026-1062

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticat...

EUVD-2026-1063

The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

EUVD-2026-1064

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipressajaxgetposts and gamipressajaxgetusers functions in all versions up to, and including...

EUVD-2026-1080

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.7 via the 'dirpath' parameter in the 'njt-fastdup/v1/template/directory-tree' REST API endpoint. This makes it possible for authenticated attackers,...

EUVD-2026-1094

The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

EUVD-2026-0965

In imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10314745; Issue ID: MSV-5553...

GHSA-PHPV-94HG-FV9G

creationtimestamp| type| source ---|---|--- 2026-01-05 21:59:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115844736458981138 2026-01-05 23:05:27+00:00| seen| Telegram/DM3pgu0RzgLvzG-bb0EsBJeE-HNavxIR4FBWximsYdDyCg...

CVE-2026-0625

creationtimestamp| type| source ---|---|--- 2026-01-05 21:28:35+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115844613054542200 2026-01-05 23:05:33+00:00| published-proof-of-concept| Telegram/SaQdu2HuKivKnxzQDHW0crSXnl1eIl3nAV9Cs1OYgaU4ueA 2026-01-05 23:05:39+00:00| seen|...

GHSA-6G8Q-HP2J-GVWV

creationtimestamp| type| source ---|---|--- 2026-01-05 20:33:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115844394905204282 2026-01-08 14:01:19+00:00| seen| Telegram/MF5MbKH9Dl27A-oSLc1JrD-xlLt5sgTckbUHyznbnX30sc...