Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 117 threats · Saturday, Oct 17· last check 2026-11-04 07:34 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Saturday, Oct 17

Most severe in everything

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints…phpmyfaq/phpmyfaq1 talking

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10…

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth providermage-ai

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable…

Saturday, Oct 17

NOT SCOREDNOT SCOREDCVE-2026-108117 withdrawn by its CVE Numbering Authority, no flawOther2026-10-17 23:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-107772 was rejected by its numbering authority, no flawOther2026-10-17 23:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-107345 was rejected and withdrawn by its numbering authorityOther2026-10-17 23:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-107274 was rejected and withdrawn by its numbering authorityOther2026-10-17 23:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-105391 rejected by its numbering authority, no flawOther2026-10-17 23:16 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Failures from Twilio Alphanumeric Sender Type to Multiple Networks in TurkeyTwilioVendor2026-10-17 23:14 UTCby status page–WHAT TO DO MEDIUM5.3YOLOE model loader lets crafted model metadata run code locallyTHU-MIG/yoloeAI agents & MCP2026-10-17 21:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.3Coder: forged X-Forwarded-For bypasses login rate limits and audit IPsOther2026-08-11 11:22 UTCby NVD–WHAT TO DO MEDIUM6.3Coder: login responses let attackers enumerate valid accountsPackage2026-06-12 15:00 UTCby NVD–WHAT TO DO MEDIUM4.8Coder: stored HTML injection in appearance settings hits dashboard and emailsInfrastructure2026-06-12 15:00 UTCby NVD–WHAT TO DO MEDIUM5.3Coder: open redirect in API key handling sends users to attacker sitesInfrastructure2026-08-10 10:00 UTCby NVD–WHAT TO DO MEDIUM5.3Coder: workspace ACL endpoint leaks group members' emails and login detailsAI agents & MCP2026-08-10 10:05 UTCby NVD–WHAT TO DO MEDIUM6.0Coder: provisioner daemons can download other organizations' cached Terraform modulesOther2026-08-10 10:05 UTCby NVD–WHAT TO DO MEDIUM5.4Coder: removed organization members keep access to org resourcesOther2026-08-10 10:00 UTCby NVD–WHAT TO DO HIGH8.7Coder: hostname check lets prefix domains steal workspace API keyscoderOther2026-08-10 10:00 UTCby InfraStack Analyst–FIX 2.35.4 MEDIUM4.8Coder: unauthenticated agent debug server leaks workspace environment secretsInfrastructure2026-08-10 10:00 UTCby NVD–WHAT TO DO HIGH8.7Fleet: gzip request bodies exhaust memory and crash the serverPackage2026-10-02 15:46 UTCby NVD–WHAT TO DO HIGH8.7Fleet MDM server: crafted enrollment plist crashes server via recursionfleetOther2026-10-02 15:29 UTCby InfraStack Analyst–FIX 4.89.0 HIGH7.2Vikunja: permissive CORS lets any localhost page steal login tokensPackage2026-10-03 06:32 UTCby NVD–WHAT TO DO MEDIUM5.4Vikunja: project writers can delete admin-tier link sharesPackage2026-10-03 06:31 UTCby NVD–WHAT TO DO MEDIUM5.3Vikunja: parent project write access overrides read-only child project sharesPackage2026-10-03 06:31 UTCby NVD–WHAT TO DO HIGH7.1Vikunja: removed collaborators keep receiving project data via webhooksPackage2026-10-03 06:31 UTCby NVD–WHAT TO DO MEDIUM5.4Vikunja: authenticated users can write task position rows instance-widePackage2026-10-03 06:31 UTCby NVD–WHAT TO DO HIGH7.1Vikunja: revoked sessions keep WebSocket access to notificationsPackage2026-10-03 06:31 UTCby NVD–WHAT TO DO MEDIUM6.9Admidio: unauthenticated users can read role-restricted weblinks via RSS feedPackage2026-10-02 18:01 UTCby NVD–WHAT TO DO HIGH7.1Admidio: broken access control exposes inventory data when module disabledPackage2026-10-02 18:01 UTCby NVD–WHAT TO DO MEDIUM5.3Admidio: authenticated users bypass export restriction to download member listsPackage2026-10-02 18:00 UTCby NVD–WHAT TO DO HIGH7.1Admidio: forum topic IDOR lets members overwrite other users' topicsPackage2026-10-02 18:00 UTCby NVD–WHAT TO DO CRITICAL9.8phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints…phpmyfaq/phpmyfaq1 talkingPackage2026-10-03 11:35 UTCby InfraStack Analyst1talkingFIX 4.1.9 HIGH7.1phpMyFAQ: attachment download skips permission checks on restricted FAQsPackage2026-10-03 11:38 UTCby NVD–WHAT TO DO HIGH8.1phpMyFAQ: missing authorization lets delete-user holders remove superadmin accountsPackage2026-10-03 11:37 UTCby NVD–WHAT TO DO HIGH8.7phpMyFAQ: edit permission lets users rewrite FAQs they cannot viewPackage2026-10-03 11:37 UTCby NVD–WHAT TO DO HIGH7.1phpMyFAQ: admin database update endpoint lacks CSRF checks, enabling forced migrationsPackage2026-10-03 11:37 UTCby NVD–WHAT TO DO HIGH7.1phpMyFAQ: missing CSRF checks let attackers drop or rebuild search indexesPackage2026-10-03 11:36 UTCby NVD–WHAT TO DO HIGH7.0phpMyFAQ: admin user API leaks any user's TOTP secretPackage2026-10-03 11:36 UTCby NVD–WHAT TO DO MEDIUM6.9phpMyFAQ: open-questions API leaks hidden questions and usernames to anonymous usersPackage2026-10-03 11:36 UTCby NVD–WHAT TO DO MEDIUM5.4phpMyFAQ: SVG sanitizer bypass lets editors plant clickable scriptPackage2026-10-03 11:36 UTCby NVD–WHAT TO DO MEDIUM6.9phpMyFAQ: missing translation lets anonymous users read restricted FAQ commentsPackage2026-10-03 11:35 UTCby NVD–WHAT TO DO HIGH8.7phpMyFAQ: unauthenticated API requests exhaust memory and crash the serverphpmyfaq/phpmyfaqPackage2026-10-03 11:35 UTCby InfraStack Analyst–FIX 4.2.0-beta MEDIUM5.3phpMyFAQ: authenticated users can download attachments from draft FAQsPackage2026-10-03 11:35 UTCby NVD–WHAT TO DO HIGH7.7phpMyFAQ: Keycloak login lets attackers take over local accountsPackage2026-10-03 11:34 UTCby NVD–WHAT TO DO HIGH7.1phpMyFAQ: category-restricted editors can change attachments on other FAQsPackage2026-10-03 11:34 UTCby NVD–WHAT TO DO MEDIUM5.4phpMyFAQ: SVG sanitizer flaw lets editors store script that runs in users' browsersPackage2026-10-03 11:33 UTCby NVD–WHAT TO DO HIGH7.6phpMyFAQ: Entra ID login lets attacker take over local accountsPackage2026-10-03 11:33 UTCby NVD–WHAT TO DO MEDIUM5.4phpMyFAQ: stored XSS via data:text/html iframes in FAQ and newsPackage2026-10-03 11:33 UTCby NVD–WHAT TO DO HIGH8.5phpMyFAQ: category-restricted admins can grant themselves unrestricted category accessPackage2026-10-03 11:32 UTCby NVD–WHAT TO DO MEDIUM6.9phpMyFAQ: missing rate limits let anyone flood password reset emailsPackage2026-10-03 11:30 UTCby NVD–WHAT TO DO HIGH7.0phpMyFAQ: group permission API lets scoped admins gain unrestricted accessRuntime2026-10-03 11:29 UTCby NVD–WHAT TO DO HIGH7.0phpMyFAQ: admins can grant themselves unrestricted rights across all languagesRuntime2026-10-03 11:29 UTCby NVD–WHAT TO DO MEDIUM5.3phpMyFAQ: admin dashboard exposes restricted data to any logged-in userRuntime2026-10-03 11:29 UTCby NVD–WHAT TO DO MEDIUM5.1phpMyFAQ: delegated admins can rewrite news without the edit rightPackage2026-10-03 11:28 UTCby NVD–WHAT TO DO MEDIUM6.9phpMyFAQ: comment endpoint leaks which display names and emails are registeredRuntime2026-10-03 11:28 UTCby NVD–WHAT TO DO HIGH7.1phpMyFAQ: 2FA removal endpoint lacks brute-force lockout, allowing TOTP guessingPackage2026-10-03 11:28 UTCby NVD–WHAT TO DO HIGH7.0phpMyFAQ: admins can delete higher-privileged groups via crafted requestRuntime2026-10-03 11:28 UTCby NVD–WHAT TO DO HIGH8.7phpMyFAQ: email change skips password check, enabling account takeoverPackage2026-10-03 11:27 UTCby NVD–WHAT TO DO HIGH8.6phpMyFAQ: SSO login skips TOTP two-factor check, granting admin sessionsPackage2026-10-03 11:26 UTCby NVD–WHAT TO DO HIGH7.6FreeRDP: crafted clipboard BMP causes crash or out-of-bounds writePackage2026-10-02 10:01 UTCby NVD–WHAT TO DO HIGH8.3FreeRDP: crafted NTLM message writes past heap buffer, unauthenticatedPackage2026-10-02 10:03 UTCby NVD–WHAT TO DO MEDIUM4.3SMS Alert Order Notifications WordPress plugin: missing authorization check, through 4.0.1Package2026-10-17 19:16 UTCby NVD–WHAT TO DO MEDIUM4.2Coder: session expiry bypass keeps revoked OIDC users signed inInfrastructure2025-08-28 17:31 UTCby NVD–WHAT TO DO MEDIUM5.3Coder: login page open redirect lets attackers send users to phishing sitesPackage2024-10-28 15:04 UTCby NVD–WHAT TO DO HIGH7.1PAYCOMET for WooCommerce: reflected XSS lets attackers run scripts in shoppers' browsersPackage2026-10-17 17:16 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: 5300 Errors on Singapore Client EdgeTwilioVendor2026-10-17 17:07 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tonemaptts (PyPI)tonemapttsPackage2026-10-17 17:06 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in pyrechoasr (PyPI)pyrechoasrPackage2026-10-17 17:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in driftwavets (PyPI)driftwavetsPackage2026-10-17 17:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in novalithtts (PyPI)novalithttsPackage2026-10-17 17:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in voltswannts (PyPI)voltswanntsPackage2026-10-17 17:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in glassbeakasr (PyPI)glassbeakasrPackage2026-10-17 17:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in emberlytts (PyPI)emberlyttsPackage2026-10-17 17:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in quasitonnts (PyPI)quasitonntsPackage2026-10-17 17:03 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ukraine69 (PyPI)ukraine69Package2026-10-17 16:53 UTCby osv-malicious–UNINSTALL HIGH7.5Gantry 5 Framework: error messages leak sensitive data to visitorsRuntime2026-10-17 11:16 UTCby NVD–WHAT TO DO HIGH7.2GetPaid WordPress plugin: unauthenticated stored XSS through a form parameterPackage2026-10-17 08:16 UTCby NVD–WHAT TO DO MEDIUM5.4weForms WordPress plugin: unauthenticated attackers can delete arbitrary media filesPackage2026-10-17 08:16 UTCby NVD–WHAT TO DO MEDIUM6.4YMC Filter WordPress plugin: stored XSS via post title fieldPackage2026-10-17 08:16 UTCby NVD–WHAT TO DO HIGH7.2WooCommerce VAT plugin: unauthenticated stored XSS via CF-IPCountry headerPackage2026-10-17 08:16 UTCby NVD–WHAT TO DO HIGH7.1WordPress Fancy Comments plugin: reflected XSS through 1.2.21Package2026-10-17 07:16 UTCby NVD–WHAT TO DO MEDIUMINCIDENTSupabase: Project creation errors ap-ne1SupabaseVendor2026-10-17 06:27 UTCby status page–WHAT TO DO MEDIUM6.5ThirstyAffiliates WordPress plugin leaks unpublished affiliate link destinationsPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM6.5WordPress Patreon plugin: missing nonce lets attackers relink an admin's Patreon accountPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM4.3Patreon WordPress plugin: open redirect lets attackers send visitors to phishing sitesPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO LOW3.7Patreon WordPress plugin: unauthenticated users can list taxonomy term namesPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM6.8BSK PDF Manager WordPress plugin: SQL injection lets contributors read password hashesPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM6.6ACF Frontend Admin WordPress plugin: unrestricted PHP object deserialization enables code executionPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM5.3ACF Frontend Admin WordPress plugin lets visitors overwrite site-wide optionsPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM5.3WP User Manager plugin lets unpaid users keep accounts after failed paymentPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM5.0WP Data Access WordPress plugin: missing checks let subscribers scan internal hostsPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM5.9WordPress Contact Form 7 Signature Addon: path traversal attaches server files to emailPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM6.8Ukr-To-Lat WordPress plugin: term name lets contributors run SQL injectionPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO MEDIUM5.3PeachPay WooCommerce plugin leaks order keys to unauthenticated requestsPackage2026-10-17 06:16 UTCby NVD–WHAT TO DO HIGH7.2WordPress User Registration plugin: unauthenticated stored XSS via checkbox fieldPackage2026-10-17 04:17 UTCby NVD–WHAT TO DO MEDIUM4.3WordPress membership plugin: forged requests approve or deny user accountsPackage2026-10-17 04:17 UTCby NVD–WHAT TO DO HIGH8.1WordPress User Registration plugin: unauthenticated shortcode execution via referer headerPackage2026-10-17 04:17 UTCby NVD–WHAT TO DO MEDIUM4.3Tutor LMS WordPress plugin: authors can overwrite other instructors' coursesPackage2026-10-17 04:17 UTCby NVD–WHAT TO DO MEDIUM6.4Themify Builder WordPress plugin: stored XSS via shortcode attributePackage2026-10-17 04:16 UTCby NVD–WHAT TO DO MEDIUM4.9WordPress Post Export Import plugin: directory traversal via theme_slug parameterPackage2026-10-17 04:16 UTCby NVD–WHAT TO DO MEDIUM6.4Themify Popup for WordPress: stored script injection via popup width settingPackage2026-10-17 04:16 UTCby NVD–WHAT TO DO MEDIUM6.4xSpeed Cache WordPress plugin: stored XSS via content parameterPackage2026-10-17 04:16 UTCby NVD–WHAT TO DO MEDIUM6.8WP Booking System plugin: authorization bypass lets subscribers grant themselves form edit accessPackage2026-10-17 04:16 UTCby NVD–WHAT TO DO MEDIUM6.5WP Booking System plugin: subscribers can read private booking descriptions and IDsPackage2026-10-17 04:16 UTCby NVD–WHAT TO DO HIGH7.5WP Booking System plugin: authorization bypass exposes customer booking emailsPackage2026-10-17 04:16 UTCby NVD–WHAT TO DO MEDIUM4.9Welcart e-Commerce WordPress plugin: SQL injection lets editors read databasePackage2026-10-17 04:16 UTCby NVD–WHAT TO DO MEDIUM6.5LearnPress WordPress plugin: subscribers can extract admin email addressesPackage2026-10-17 04:16 UTCby NVD–WHAT TO DO CRITICAL9.8The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10…Package2026-10-17 04:16 UTCby NVD–WHAT TO DO HIGH7.2WordPress EU VAT Assistant plugin: stored XSS via vat_number escalates to admin takeoverPackage2026-10-17 04:16 UTCby NVD–WHAT TO DO LOW3.7LatePoint WordPress plugin: unauthenticated customer data exposure via AJAX endpointPackage2026-10-17 03:16 UTCby NVD–WHAT TO DO MEDIUM6.1Hippoo Mobile App for WooCommerce: reflected XSS via token_id parameterPackage2026-10-17 03:16 UTCby NVD–WHAT TO DO CRITICAL9.1The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable…Package2026-10-17 03:16 UTCby NVD–WHAT TO DO HIGH7.2LearnPress WordPress LMS plugin: stored XSS via checkout and REST fieldsPackage2026-10-17 03:16 UTCby NVD–WHAT TO DO MEDIUM4.3Fastcache by Host.it WordPress plugin: subscribers can edit .htaccess rulesPackage2026-10-17 03:16 UTCby NVD–WHAT TO DO HIGH7.5Kirki WordPress plugin: unauthenticated attackers read other users' profile dataPackage2026-10-17 03:16 UTCby NVD–WHAT TO DO HIGH7.2Kirki WordPress plugin: object injection lets authenticated editors trigger code pathsPackage2026-10-17 03:16 UTCby NVD–WHAT TO DO HIGH7.5Tektronix 3 Series MDO: path traversal in web interface reads arbitrary filesInfrastructure2026-10-17 02:17 UTCby NVD–WHAT TO DO HIGH8.1Tektronix 3 Series MDO: path traversal lets remote users read or change device filesInfrastructure2026-10-17 02:17 UTCby NVD–WHAT TO DO HIGH8.8Tektronix MDO oscilloscopes: SCPI mount command lets remote attackers run OS commandsInfrastructure2026-10-17 02:17 UTCby NVD–WHAT TO DO CRITICAL9.8Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth providermage-aiOther2026-10-17 02:17 UTCby InfraStack Analyst–WHAT TO DO

Friday, Oct 16Saturday, Oct 17Sunday, Oct 18