Security News

Critical vulnerabilities, as they're published

We track newly-disclosed CVEs in CMS platforms, plugins, and e-commerce software — WordPress, Magento, WooCommerce and more — so you know when something could affect your website.

CRITICAL 9.3 CVE-2026-39732 30 Oct 2026

Transliterator Plugin SQL Injection Vulnerability

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

CRITICAL 9.8 CVE-2026-119526 30 Oct 2026

ThemeREX Royal Event Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

CRITICAL 9.1 CVE-2026-116852 30 Oct 2026

Widget Options Plugin Author RCE Vulnerability

Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

CRITICAL 9.8 CVE-2026-116386 30 Oct 2026

SMS Alert Order Notifications Plugin Privilege Escalation Vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.

CRITICAL 9.8 CVE-2026-61737 30 Oct 2026

ng-antd-admin Hardcoded JWT Secret Allows Authentication Bypass

ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints, leading to account takeover, data leakage and unauthorized operations. Version 22.0 rejects the shipped secret in pr…

CRITICAL 9.9 CVE-2026-61728 30 Oct 2026

SOCFortress CoPilot Stored XSS Vulnerability

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit stored markup through `POST /api/incidents/db_operations/alert/comment`. In `customer-portal/src/components/alerts/AlertDetails/AlertComment.vue`, `commentHtml` replaces newlines in `comment.comment` but passes the result to `v-html` without es…

CRITICAL 9.8 CVE-2026-119660 30 Oct 2026

MuseBot Authentication Bypass Lets Attackers Forge Admin Sessions

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.

CRITICAL 9.0 CVE-2026-112905 30 Oct 2026

Vvveb CMS Admin API Token IDOR Vulnerability

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7.

CRITICAL 9.8 CVE-2026-110799 30 Oct 2026

Vvveb CMS Password Reset Authentication Bypass Vulnerability

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.

CRITICAL 9.8 CVE-2026-119597 30 Oct 2026

OpenDeepWiki Hard-Coded JWT Key Lets Attackers Forge Admin Tokens

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.

CRITICAL 9.8 CVE-2026-103039 30 Oct 2026

Gravity Forms WordPress Plugin PHP Object Injection Vulnerability

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the…

CRITICAL 9.8 CVE-2026-107249 30 Oct 2026

Drupal Block AJAX Object Injection Vulnerability

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

CRITICAL 9.0 CVE-2026-61707 29 Oct 2026

SOCFortress CoPilot Jinja2 Template Injection Vulnerability

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. The `/case-report-template/upload` route in `backend/app/incidents/routes/db_operations.py` validates only the filename-derived MIME type, not the te…

CRITICAL 9.1 CVE-2026-61645 29 Oct 2026

Docat Arbitrary File Upload Vulnerability

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect us…

CRITICAL 9.8 CVE-2026-62131 29 Oct 2026

Think your server has been compromised?

Tell us what happened. We'll review your request and provide an initial response within 1 hour.

Get Emergency Help help@myserverhacked.com