Security News

Critical vulnerabilities, as they're published

We track newly-disclosed CVEs with a critical CVSS score so you know when something could affect your servers.

CRITICAL 9.8 CVE-2026-10522 29 Aug 2026

WordPress MemberHero Plugin Admin Takeover Bug

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over

CRITICAL 9.9 CVE-2026-55634 28 Aug 2026

Pimcore Data Object Injection Vulnerability

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is emitted without an identifier allowlist by lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php into generated PHP properties and by models/DataObject/ClassDefinition/Helper/Dao.php into ALTER TABLE identifiers

CRITICAL 9.1 CVE-2026-55248 28 Aug 2026

Plone RSS Portlet Denial of Service

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe interna

CRITICAL 9.1 CVE-2026-55247 28 Aug 2026

Plone iCalendar Import Vulnerability

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per event. A logged-in editor can make the server request internal network resources or local calendar files, exhaust resources and take the site offline, and store a malicious event URL

CRITICAL 9.8 CVE-2026-81578 28 Aug 2026

PaperCut MF/NG Unauthenticated Admin Access

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

CRITICAL 9.1 CVE-2026-82244 28 Aug 2026

Budibase RCE via Malicious Plugin Upload

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval() on plugin JavaScript files without sandboxing in the main Node.js process, enabling attackers to exfiltrate environment variables and credentials with root privileges in default deployments.

CRITICAL 10 CVE-2026-82222 28 Aug 2026

GiveWP Object Injection Flaw

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.

CRITICAL 9.8 CVE-2026-78032 28 Aug 2026

SOY CMS Arbitrary Code Execution

SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.

CRITICAL 9.8 CVE-2026-76581 28 Aug 2026

WordPress WPMU DEV Dashboard Auth Bypass

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it po

CRITICAL 9 CVE-2026-40541 28 Aug 2026

Synology Chat Server XSS File Read/Write Vulnerability

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.

CRITICAL 9.8 CVE-2026-75337 28 Aug 2026

Yu AI Code Mother Path Traversal Vulnerability

The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root.

CRITICAL 9.8 CVE-2026-37072 27 Aug 2026

Veno File Manager Admin Access Control Flaw

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.

CRITICAL 9.8 CVE-2026-37004 27 Aug 2026

BerriAI litellm SSTI Vulnerability

BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.

CRITICAL 9.8 CVE-2026-19092 27 Aug 2026

Think your server has been compromised?

Tell us what happened. We'll review your request and provide an initial response within 1 hour.

Get Emergency Help help@myserverhacked.com