Security News

Critical vulnerabilities, as they're published

We track newly-disclosed CVEs with a critical CVSS score so you know when something could affect your servers.

CRITICAL 9.3 CVE-2026-85183 3 Sept 2026

Taipy Web App Socket.IO CORS Misconfiguration

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

CRITICAL 9.8 CVE-2026-85181 3 Sept 2026

CAT Session Cookie Forgery Vulnerability

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

CRITICAL 9.9 CVE-2026-85165 3 Sept 2026

n8n Workflow Editor Permissions Bypass

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.

CRITICAL 9.8 CVE-2026-85154 3 Sept 2026

AVideo Auth Bypass via Persistent Video ID Hash

WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.

CRITICAL 9.9 CVE-2026-77009 2 Sept 2026

WordPress WatchMan-Site7 Plugin Arbitrary Code Execution

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.

CRITICAL 10 CVE-2026-4357 2 Sept 2026

WordPress Embed HTML5 Game Plugin Unauthenticated File Upload

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

CRITICAL 9.8 CVE-2025-9314 2 Sept 2026

WordPress Developer Tools Plugin File Upload Bug

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component

CRITICAL 9.1 CVE-2026-73475 2 Sept 2026

Drupal Commerce PayPal Forceful Browsing Bug

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

CRITICAL 9 CVE-2026-84803 2 Sept 2026

SiYuan XSS Vulnerability in Asset Serving

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

CRITICAL 9.8 CVE-2026-84795 2 Sept 2026

Craft CMS Admin Privilege Escalation

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

CRITICAL 9.8 CVE-2026-81294 2 Sept 2026

Authorizer Plugin Privilege Escalation

Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.

CRITICAL 9.3 CVE-2026-81286 2 Sept 2026

WCFM Marketplace SQL Injection

Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

CRITICAL 9.8 CVE-2026-78657 2 Sept 2026

WordPress SigmaForms Pro File Deletion Bug

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form

CRITICAL 9.8 CVE-2026-9055 2 Sept 2026

WordPress Amelia Plugin Privilege Escalation

The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticate

CRITICAL 9.8 CVE-2026-84480 1 Sept 2026

AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.

CRITICAL 9.1 CVE-2026-84479 1 Sept 2026

AVideo Login Bypass via User-Agent Spoofing

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being r

CRITICAL 9 CVE-2026-75604 1 Sept 2026

Next.js Windows Path Traversal Vulnerability

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can

CRITICAL 9.8 CVE-2026-52111 1 Sept 2026

Shopify App Fast Note Sync Privilege Escalation

An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey

CRITICAL 9.8 CVE-2026-18210 1 Sept 2026

Store SQL Injection Flaw

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2.

CRITICAL 9.8 CVE-2026-18550 1 Sept 2026

Nokri WordPress Theme Password Reset Bug

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators

Page 6 of 18 (345 total)

Think your server has been compromised?

Tell us what happened. We'll review your request and provide an initial response within 1 hour.

Get Emergency Help help@myserverhacked.com