Threat briefs

CVE-2026-64561 identifies a flaw in the Linux KVM hypervisor where incorrect validation of MMU pages could lead to memory management inconsistencies.

An integer overflow vulnerability (CVE-2024-55656) in the RedisBloom module's CMS.INITBYDIM command enables heap underallocation, allowing authenticated attackers to perform out-of-bounds memory operations and achieve remote code execution.

OpenAM versions prior to 16.1.3 are vulnerable to unauthenticated arbitrary class instantiation via the legacy JAX-RPC SOAP interface, enabling potential remote code execution.

Fortra released patches for three critical vulnerabilities in its Core Privileged Access Manager (BoKS) software, addressing authentication bypass, command injection, and memory corruption flaws.

The WPC Product Options for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via improper sanitization of multipart form field names starting with 'wpcpo-'.

The WP Visitor Statistics plugin (up to 8.7) is vulnerable to a second-order SQL injection allowing unauthenticated attackers to exfiltrate database information via the 'fullRef' parameter.

An authorization bypass vulnerability in the Nelio Content WordPress plugin allows authenticated contributors to delete arbitrary reusable social messages.

The WP Mail Catcher plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via inadequate sanitization of PHPMailer error messages, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative sessions.

The WPCafe WordPress plugin contains a local file inclusion vulnerability in its template scope function, allowing authenticated contributors to execute arbitrary PHP files.

An authenticated SQL injection vulnerability in the Smart Manager plugin for WordPress allows subscriber-level users to perform database exfiltration through the access_privileges parameter.

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion via insufficient path validation in the extract function, which can lead to remote code execution.

Craft CMS versions 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 contain a critical vulnerability allowing authenticated users to achieve remote code execution by injecting malicious payloads into improperly validated redirect parameters.

An unauthenticated Stored DOM-Based XSS vulnerability in the Visitor Traffic Real Time Statistics plugin allows attackers to inject malicious scripts via the 'X-Real-IP' header.

The Simple Membership plugin for WordPress is vulnerable to unauthenticated account activation and credential disclosure due to insufficient input validation in activation-related endpoints.

The Strong Testimonials WordPress plugin (up to version 3.3.11) is vulnerable to stored Cross-Site Scripting (XSS) via the 'platform_user_photo' custom field, allowing unauthenticated attackers to execute malicious scripts in victims' browsers.

An unauthenticated stored XSS vulnerability in The Transliterator plugin (<= 2.5.8) allows attackers to inject malicious JavaScript into WordPress comments, leading to arbitrary code execution in the context of site viewers.

A stored XSS vulnerability in SEOPress versions up to 10.2 allows unauthenticated attackers to execute arbitrary scripts by injecting malicious code into the Author Display Name field.

An unauthenticated Stored Cross-Site Scripting vulnerability in the GD Rating System plugin for WordPress allows attackers to execute arbitrary JavaScript via the gdrts_live_handler AJAX action by bypassing a trivially accessible nonce.

An unauthenticated stored Cross-Site Scripting vulnerability in the Welcart e-Commerce WordPress plugin allows attackers to inject malicious scripts via settlement notification parameters.

The GeoDirectory WordPress plugin (<= 2.8.186) is vulnerable to SQL injection, allowing authenticated attackers to execute arbitrary database queries via improper coordinate sanitization in the geodir_gps_query_part function.

An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Magic Tooltips For Contact Form 7 plugin up to version 1.0.34 allows attackers to inject malicious scripts via the author parameter.

An unauthenticated arbitrary content deletion vulnerability in the Photo Reviews for WooCommerce plugin (CVE-2026-101923) allows attackers to delete arbitrary site posts, pages, or media by injecting malicious IDs into review metadata.

A Server-Side Template Injection (SSTI) vulnerability in Mautic's theme engine allows authenticated users with theme creation or upload privileges to execute arbitrary system commands (Remote Code Execution) and access restricted system files on the hosting server, due to the platform rendering uploaded Twig templates without a sandbox or strict function restrictions.

The Real Cookie Banner plugin (<= 5.3.5) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via inadequate input sanitization in comment anchor tags, allowing unauthenticated attackers to execute arbitrary scripts in the browser context of site visitors.

The ProfilePress plugin for WordPress (<= 4.17.4) is vulnerable to sensitive information exposure, allowing authenticated and unauthenticated attackers to extract user PII via crafted shortcode parameters.

The Ultimate Member WordPress plugin (<= 2.13.1) contains a stored XSS vulnerability in the form_id parameter, allowing unauthenticated attackers to execute arbitrary scripts in the administrator dashboard.

An authorization bypass vulnerability in the Ultimate Member WordPress plugin allows unauthenticated attackers to exfiltrate private profile data via the wp_ajax_nopriv_um_get_members endpoint.

The Headroom WebSocket server lacks Origin header validation, enabling Cross-Site WebSocket Hijacking that allows unauthorized parties to perform LLM requests via an injected OpenAI API key.

The Praxis proxy server is susceptible to a denial-of-service attack due to improper HTTP/2 header processing, allowing unauthenticated attackers to exhaust server memory through crafted HPACK compression sequences.

An unauthenticated remote attacker can trigger a Denial of Service (DoS) in Node.js applications using @fastify/busboy by submitting crafted multipart/form-data headers naming '__proto__' or 'constructor'.