CVE-2026-15397 Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wpssfwinstallpluginconfiguration AJAX handler. This...

CVE-2026-15397

The CVE concerns the WordPress plugin Subscriptions for WooCommerce (versions ≤ 2.0.0). The issue is Missing Authorization in the AJAX handler wps_sfw_install_plugin_configuration , allowing authenticated users with shop manager-level access or higher to install and activate arbitrary WordPress.o...

CVE-2026-15397

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wpssfwinstallpluginconfiguration AJAX handler. This...

EUVD-2026-51089

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wpssfwinstallpluginconfiguration AJAX handler. This...

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia

Introduction We have been tracking two new backdoors, OctLurk and SilkLurk , observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab...

WordPress miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin < 7.8.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Lyris Vale in WordPress Plugin WordPress Social Login and Register versions 7.8.0...

WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by AeonRisk in WordPress Plugin MountDev AI MCP Connector for WordPress versions = 1.6.1...

CLEANSTART-2026-AY89794 Security fixes in velero-plugin-for-gcp-fips 1.13.1-r2

Package velero-plugin-for-gcp-fips version 1.13.1-r2 fixes 3 vulnerabilities: CVE-2026-27140, CVE-2026-39883, ghsa-hfvc-g4fc-pqhx...

CLEANSTART-2026-RE00985 Security fixes in velero-plugin-for-microsoft-azure-fips 1.14.0-r2

Package velero-plugin-for-microsoft-azure-fips version 1.14.0-r2 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-33814, CVE-2026-33811...

CLEANSTART-2026-QV45802 Security fixes in velero-plugin-for-csi 0.7.1-r1

Package velero-plugin-for-csi version 0.7.1-r1 fixes 1 vulnerabilities: CVE-2025-61729...

CLEANSTART-2026-EB42523 Security fixes in velero-plugin-for-csi 0.7.1-r3

Package velero-plugin-for-csi version 0.7.1-r3 fixes 3 vulnerabilities: CVE-2026-42507, CVE-2026-42504, CVE-2026-27145...

CLEANSTART-2026-RU30186 Security fixes in kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r6

Package kyverno-policy-reporter-kyverno-plugin-fips version 1.4.2-r6 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-25679, CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-AC75649 Security fixes in velero-plugin-for-gcp-fips 1.13.2-r2

Package velero-plugin-for-gcp-fips version 1.13.2-r2 fixes 5 vulnerabilities: CVE-2026-34986, CVE-2026-32283, CVE-2026-32281, ghsa-hfvc-g4fc-pqhx, ghsa-78h2-9frx-2jm8...

CLEANSTART-2026-RW79431 Security fixes in velero-plugin-for-microsoft-azure-fips 1.14.0-r1

Package velero-plugin-for-microsoft-azure-fips version 1.14.0-r1 fixes 9 vulnerabilities: CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-32283, CVE-2026-27140...

CLEANSTART-2026-VZ08773 Security fixes in kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r2

Package kyverno-policy-reporter-kyverno-plugin-fips version 1.3.1-r2 fixes 1 vulnerabilities: CVE-2022-1996...

CLEANSTART-2026-GU70842 Security fixes in velero-plugin-for-csi 0.5.1-r2

Package velero-plugin-for-csi version 0.5.1-r2 fixes 5 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505, CVE-2026-56852...

CLEANSTART-2026-DP84010 Security fixes in velero-plugin-for-aws 1.12.2-r6

Package velero-plugin-for-aws version 1.12.2-r6 fixes 12 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502...

CLEANSTART-2026-ON20634 Security fixes in velero-plugin-for-gcp-fips 1.13.2-r1

Package velero-plugin-for-gcp-fips version 1.13.2-r1 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-YM99936 Security fixes in velero-plugin-for-aws 1.14.0-r1

Package velero-plugin-for-aws version 1.14.0-r1 fixes 8 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-33810, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282...

CLEANSTART-2026-OQ60527 Security fixes in velero-plugin-for-gcp-fips 1.13.2-r0

Package velero-plugin-for-gcp-fips version 1.13.2-r0 fixes 6 vulnerabilities: CVE-2026-27142, CVE-2026-27139, CVE-2026-34986, CVE-2026-24051, CVE-2026-25679...