The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a f... This is a low threat mapped to CVE-2026-84223; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-84223

Read full intelligence briefing on SecOpsPulse

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolv... This is a low threat mapped to CVE-2026-82842; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-82842

Read full intelligence briefing on SecOpsPulse

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users g... This is a low threat mapped to CVE-2026-81654; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-81654

Read full intelligence briefing on SecOpsPulse

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its g... This is a low threat mapped to CVE-2026-81653; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-81653

Read full intelligence briefing on SecOpsPulse

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing us... This is a high threat mapped to CVE-2026-81652; security leaders should validate exposure, prioritize patching, and verify compensati...

CVEs: CVE-2026-81652

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capa... This is a low threat mapped to CVE-2026-81651; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-81651

Read full intelligence briefing on SecOpsPulse

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable bei... This is a low threat mapped to CVE-2026-81650; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-81650

Read full intelligence briefing on SecOpsPulse

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-pr... This is a high threat mapped to CVE-2026-16542; security leaders should validate exposure, prioritize patching, and verify compensati...

CVEs: CVE-2026-16542

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allo... This is a low threat mapped to CVE-2026-14844; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-14844

Read full intelligence briefing on SecOpsPulse

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. T... This is a medium threat mapped to CVE-2026-93965; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-93965

Read full intelligence briefing on SecOpsPulse

A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.... This is a medium threat mapped to CVE-2026-93964; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-93964

Read full intelligence briefing on SecOpsPulse

A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. The manipula... This is a medium threat mapped to CVE-2026-93963; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-93963

Read full intelligence briefing on SecOpsPulse

A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the compone... This is a high threat mapped to CVE-2026-93962; security leaders should validate exposure, prioritize patching, and verify compensati...

CVEs: CVE-2026-93962

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api... This is a medium threat mapped to CVE-2026-93961; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-93961

Read full intelligence briefing on SecOpsPulse

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Sco... This is a medium threat mapped to CVE-2026-93960; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-93960

Read full intelligence briefing on SecOpsPulse

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. This is a high threat mapped to CVE-2026-86553; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-86553

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. This is a medium threat mapped to CVE-2026-86552; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-86552

Read full intelligence briefing on SecOpsPulse

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course... This is a high threat mapped to CVE-2026-93959; security leaders should validate exposure, prioritize patching, and verify compensati...

CVEs: CVE-2026-93959

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform. This is a critical threat mapped to CVE-2026-94084; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-94084

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when the... This is a critical threat mapped to CVE-2026-94083; security leaders should validate exposure, prioritize patching, and verify compen...

CVEs: CVE-2026-94083

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argumen... This is a critical threat mapped to CVE-2026-93958; security leaders should validate exposure, prioritize patching, and verify compen...

CVEs: CVE-2026-93958

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filt... This is a medium threat mapped to CVE-2026-93957; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-93957

Read full intelligence briefing on SecOpsPulse

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the S... This is a low threat mapped to CVE-2026-86551; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-86551

Read full intelligence briefing on SecOpsPulse

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA proc... This is a medium threat mapped to CVE-2026-94057; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-94057

Read full intelligence briefing on SecOpsPulse

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory. This is a high threat mapped to CVE-2026-94056; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-94056

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. This is a low threat mapped to CVE-2026-94055; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-94055

Read full intelligence briefing on SecOpsPulse

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. This is a high threat mapped to CVE-2026-94054; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-94054

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a r... This is a high threat mapped to CVE-2026-93993; security leaders should validate exposure, prioritize patching, and verify compensati...

CVEs: CVE-2026-93993

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers... This is a high threat mapped to CVE-2026-93992; security leaders should validate exposure, prioritize patching, and verify compensati...

CVEs: CVE-2026-93992

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadat... This is a high threat mapped to CVE-2026-93991; security leaders should validate exposure, prioritize patching, and verify compensati...

CVEs: CVE-2026-93991

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encod... This is a high threat mapped to CVE-2026-93990; security leaders should validate exposure, prioritize patching, and verify compensati...

CVEs: CVE-2026-93990

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply o... This is a low threat mapped to CVE-2026-93989; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-93989

Read full intelligence briefing on SecOpsPulse

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Atta... This is a medium threat mapped to CVE-2026-93988; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-93988

Read full intelligence briefing on SecOpsPulse

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Sear... This is a low threat mapped to CVE-2026-93956; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-93956

Read full intelligence briefing on SecOpsPulse

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org... This is a medium threat mapped to CVE-2026-93955; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-93955

Read full intelligence briefing on SecOpsPulse

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This is a low threat mapped to CVE-2026-89155; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-89155

Read full intelligence briefing on SecOpsPulse

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/j... This is a medium threat mapped to CVE-2026-93954; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-93954

Read full intelligence briefing on SecOpsPulse

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connectio...

CVEs: CVE-2026-82672

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its in... This is a low threat mapped to CVE-2026-82560; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-82560

Read full intelligence briefing on SecOpsPulse

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. This is a medium threat mapped to CVE-2026-94001; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-94001

Read full intelligence briefing on SecOpsPulse

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. This is a medium threat mapped to CVE-2026-94000; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-94000

Read full intelligence briefing on SecOpsPulse

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. This is a medium threat mapped to CVE-2026-93999; security leaders should validate exposure, prioritize patching, and verify compensating controls.

CVEs: CVE-2026-93999

Read full intelligence briefing on SecOpsPulse

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8 due to insufficient es... This is a medium threat mapped to CVE-2026-9855; security leaders should validate exposure, prioritize patching, and verify compensat...

CVEs: CVE-2026-9855

Read full intelligence briefing on SecOpsPulse

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. Th... This is a medium threat mapped to CVE-2026-9832; security leaders should validate exposure, prioritize patching, and verify compensat...

CVEs: CVE-2026-9832

Read full intelligence briefing on SecOpsPulse

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_dea... This is a medium threat mapped to CVE-2026-9615; security leaders should validate exposure, prioritize patching, and verify compensat...

CVEs: CVE-2026-9615

Read full intelligence briefing on SecOpsPulse

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes i... This is a medium threat mapped to CVE-2026-9232; security leaders should validate exposure, prioritize patching, and verify compensat...

CVEs: CVE-2026-9232

Read full intelligence briefing on SecOpsPulse

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0... This is a medium threat mapped to CVE-2026-87917; security leaders should validate exposure, prioritize patching, and verify compensat...

CVEs: CVE-2026-87917

Read full intelligence briefing on SecOpsPulse

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode... This is a high threat mapped to CVE-2026-85658; security leaders should validate exposure, prioritize patching, and verify compensatin...

CVEs: CVE-2026-85658

Recommended Security Defense: Enterprise Vulnerability Management & Continuous Scanning

Read full intelligence briefing on SecOpsPulse

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin no... This is a medium threat mapped to CVE-2026-7527; security leaders should validate exposure, prioritize patching, and verify compensat...

CVEs: CVE-2026-7527

Read full intelligence briefing on SecOpsPulse

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including, 1.0.36 due to insuf... This is a medium threat mapped to CVE-2026-75959; security leaders should validate exposure, prioritize patching, and verify compensa...

CVEs: CVE-2026-75959

Read full intelligence briefing on SecOpsPulse