Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 126 threats · Saturday, Oct 31· last check 2026-11-04 06:18 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Saturday, Oct 31

Most severe in everything

EXPLOITED IN THE WILD

WordPress Core: predictable upgrade paths let attackers run code on the serverWordPress2 talking

BREACHNO CVE YET

Chainalysis breached by an attacker using AI agent tooling: names, emails, user IDs and roles of customer platform users exposedChainalysis2 talking

Apache MINA 3.0 codec: Java deserialization lets a peer run code

AJ-Report: hard-coded JWT secret lets attackers run code remotelyAJ-Report

Saturday, Oct 31

MEDIUM5.8YznCMS: auth group handler flaw enables improper privilege managementOther2026-10-31 23:17 UTCby EPSS–WHAT TO DO HIGH8.2Apache Thrift Java bindings: uncontrolled recursion crashes or stalls servicesPackage2026-10-31 21:16 UTCby EPSS–WHAT TO DO CRITICAL9.8Apache MINA 3.0 codec: Java deserialization lets a peer run codePackage2026-10-31 21:16 UTCby EPSS–WHAT TO DO LOWINCIDENTSupabase: PG15 -> PG17 Upgrade FailuresSupabaseVendor2026-10-31 20:06 UTCby status page–WHAT TO DO HIGH7.4Visual Studio: improper certificate validation lets attackers spoof network connectionsVisual Studio 2017 15.9Other2026-10-31 19:16 UTCby InfraStack Analyst–FIX 15.9.84 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in claims-ac1 (npm)claims-ac1Package2026-10-31 18:22 UTCby osv-malicious–UNINSTALL MEDIUM5.3FFmpeg: crafted IMF package lets attackers open files outside the packageRuntime2026-10-31 18:17 UTCby EPSS–WHAT TO DO CRITICAL9.8AJ-Report: hard-coded JWT secret lets attackers run code remotelyAJ-ReportPackage2026-10-31 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.7libheif: crafted HEIF file overflows heap and may run codePackage2026-09-01 23:27 UTCby EPSS–WHAT TO DO HIGH7.1Thelia Page Module: CSRF lets attackers delete back-office pages, images and documentsPackage2026-10-01 16:49 UTCby EPSS–WHAT TO DO MEDIUM5.9Thelia: back office CSRF lets attackers forge admin actionsOther2026-10-06 07:44 UTCby EPSS–WHAT TO DO HIGH8.0Thelia: stored script injection via customer names runs in admin viewPackage2026-09-16 09:47 UTCby EPSS–WHAT TO DO MEDIUM6.3DeepInfer: unauthenticated /profile endpoint lets remote users create arbitrary directoriesdeepinferAI agents & MCP2026-10-31 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8ShowDoc: Mock feature lets logged-in users run shell commandsPackage2026-10-31 18:17 UTCby EPSS–WHAT TO DO HIGH7.1Highflame ramparts: security scanner skips nested .pyc files, hiding malicious skill coderampartsAI agents & MCP2026-10-31 18:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Jpom: auth bypass via token header grants super-admin, then command executionOther2026-10-31 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Nexterm: authenticated users can disrupt other users' remote sessionsOther2026-10-31 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.3LearnHouse: logged-in users can read other students' grades and submissionsOther2026-10-31 18:17 UTCby EPSS–WHAT TO DO HIGH8.4Opengear console servers: overflow lets remote attacker crash index.cgiInfrastructure2026-10-31 16:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @mamans2973/maman (npm)@mamans2973/mamanPackage2026-10-31 16:09 UTCby osv-malicious–UNINSTALL HIGHTECHNIQUESMS of DeathAndroid 'SMS of Death' (CVE-2026-58882): one crafted text message crashes the phone's cellular service, with public exploit code; Android 12 and 13 get no fixAndroidRuntime2026-10-31 15:35 UTCby InfraStack Analyst–FIX 2026-10 security update (Android 14-17)HIGHNOT SCOREDWebDyne Perl: default index page leaks application source code to anyonePackage2026-10-31 15:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWebDyne: files containing .psp anywhere in name run as PerlPackage2026-10-31 15:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWebDyne Perl: request parameters reflected unescaped into form fields enable XSSPackage2026-10-31 15:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWebDyne Perl: path traversal runs .psp files outside the document rootPackage2026-10-31 15:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWebDyne Perl: session cookies lack Secure, HttpOnly and SameSite flagsPackage2026-10-31 15:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in doctreelstm (PyPI)doctreelstmPackage2026-10-31 13:39 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ms-client-portal (npm)ms-client-portalPackage2026-10-31 13:10 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in multi-convert (PyPI)multi-convertPackage2026-10-31 13:01 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in md-to-slides (PyPI)md-to-slidesPackage2026-10-31 12:57 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in skills-analyzer (PyPI)skills-analyzerPackage2026-10-31 12:55 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in is-it-ai (PyPI)is-it-aiPackage2026-10-31 12:48 UTCby osv-malicious–UNINSTALL MEDIUMCAMPAIGNDATA EXPOSEDChainalysis breached by an attacker using AI agent tooling: names, emails, user IDs and roles of customer platform users exposedChainalysis2 talkingVendor2026-10-31by InfraStack Analyst2talkingWHAT TO DO HIGHCAMPAIGNVOLTAVOLTA-AUTODOXERVOLTA infostealer for Windows steals passwords, sessions, cloud/SSH keys and crypto wallets, then uses LLMs via OpenRouter to rank each victim's most valuable assets (Talos)Windows1 talkingOther2026-10-31by InfraStack Analyst1talkingWHAT TO DO MEDIUM6.5Web 2.0 Directory WordPress plugin: unauthenticated SQL injection leaks database contentsPackage2026-10-31 12:16 UTCby EPSS–WHAT TO DO MEDIUM6.4BuddyBoss Platform WordPress plugin: group name enables stored script injectionPackage2026-10-31 10:16 UTCby EPSS–WHAT TO DO HIGH8.8NextGEN Gallery WordPress plugin: authenticated users can run code on serverNextGEN GalleryPackage2026-10-31 10:16 UTCby InfraStack Analyst–FIX 4.5.0 HIGH7.5json-glib: negative JSONPath slice step makes json_path_query hangPackage2026-10-31 10:16 UTCby InfraStack Analyst–WHAT TO DO HIGH7.2WordPress Debug Log Manager plugin: stored XSS via unauthenticated error loggingPackage2026-10-31 10:16 UTCby EPSS–WHAT TO DO MEDIUM5.5GNOME Epiphany: crafted .xpi extension file overwrites a user's writable filesPackage2026-10-31 10:16 UTCby EPSS–WHAT TO DO MEDIUM6.5Epiphany browser: clipboard approval silently grants camera and microphone accessPackage2026-10-31 10:16 UTCby EPSS–WHAT TO DO MEDIUM6.4GeoDirectory WordPress plugin: stored XSS via post_images lets subscribers run scriptsPackage2026-10-31 10:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Germanized for WooCommerce: activation token reuse exposes buyers' order dataPackage2026-10-31 10:16 UTCby EPSS–WHAT TO DO HIGH7.5WP Directory Kit WordPress plugin: unauthenticated SQL injection leaks database datawpdirectorykitOther2026-10-31 10:16 UTCby InfraStack Analyst–FIX 1.6.1 MEDIUM6.4FlexStock WooCommerce plugin: stored script injection by any subscriberPackage2026-10-31 10:16 UTCby EPSS–WHAT TO DO MEDIUM6.1WooCommerce Extra Product Options Pro: reflected XSS via product page parametersOther2026-10-31 10:16 UTCby EPSS–WHAT TO DO MEDIUM6.1Ninja Forms WordPress plugin: reflected DOM cross-site scripting via URL parameterPackage2026-10-31 10:16 UTCby EPSS–WHAT TO DO HIGH7.2WP Activity Log WordPress plugin: stored XSS through unsanitized inputPackage2026-10-31 09:16 UTCby EPSS–WHAT TO DO MEDIUM6.4WordPress Smart Post plugin: stored cross-site scripting via display_name parameterPackage2026-10-31 09:16 UTCby EPSS–WHAT TO DO CRITICAL9.8WordPress SimpleForm plugin: unauthenticated file upload leads to code executionPackage2026-10-31 09:16 UTCby EPSS–WHAT TO DO HIGH8.0konflux-ci: UI proxy skips TLS checks, letting network attacker steal cluster admin tokenkonflux-ciInfrastructure2026-10-31 09:16 UTCby InfraStack Analyst–WHAT TO DO HIGH8.4konflux-ci: repository writers can run code in CI/CD pipelinesOther2026-10-31 09:16 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8konflux-ci workflow script leaks credentials through crafted issue titlesOther2026-10-31 09:16 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6konflux-ci: CI scripts leave GitHub tokens in plaintext on runnersInfrastructure2026-10-31 09:16 UTCby InfraStack Analyst–WHAT TO DO HIGH7.2FeedWordPress: syndicated feed content stores scripts that run in visitors' browsersfeedwordpressPackage2026-10-31 09:16 UTCby InfraStack Analyst–FIX 2026.1016 MEDIUM5.3WordPress All in One SEO plugin leaks hidden post fields to anonymous visitorsPackage2026-10-31 09:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Amelia WordPress booking plugin leaks staff personal data and internal notesPackage2026-10-31 09:16 UTCby EPSS–WHAT TO DO CRITICAL9.1Acadlix LMS WordPress plugin: arbitrary file deletion leads to code executionacadlixPackage2026-10-31 09:16 UTCby InfraStack Analyst–FIX 1.2.0 MEDIUM5.3WordPress Newsletters plugin: SQL injection lets subscribers read database contentsPackage2026-10-31 09:16 UTCby EPSS–WHAT TO DO HIGH8.8User Frontend WordPress plugin: subscribers can mint editor accounts via shortcodeOther2026-10-31 08:16 UTCby EPSS–WHAT TO DO CRITICAL9.8WordPress Uncanny Toolkit for LearnDash: login check bypass lets suspended accounts inPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO HIGH7.2WordPress Shield Security plugin: stored XSS via REQUEST_URI loggingPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO MEDIUM6.4SEOPress WordPress plugin: stored script injection through display namesPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO CRITICAL9.8PUBLIC EXPLOITWordPress Project Manager plugin: unauthenticated remote code execution via id parameterPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO MEDIUM6.4PublishPress Authors WordPress plugin: stored script injection via author namePackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO MEDIUM5.4Content Pilot WordPress plugin: stored XSS via remotely fetched article metadataPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO MEDIUM5.9WP Data Access WordPress plugin: unauthenticated users can read database rowsPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO HIGH7.2WPO365 Graph Mailer WordPress plugin: unauthenticated stored XSS via mail subjectWPO365 | MICROSOFT 365 GRAPH MAILER (wpo365-msgraphmailer)Package2026-10-31 08:16 UTCby InfraStack Analyst–FIX 6.3 HIGH8.8WordPress Rox Appointment Booking plugin lets visitors take over admin accountsPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO MEDIUM6.5Redux Framework WordPress plugin: subscribers can read stored API keys and passwordsPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO MEDIUM6.1WordPress User Frontend plugin: reflected XSS via field_attr parameterPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO HIGH8.1WordPress social login plugin lets attackers log in as any userwp-socialPackage2026-10-31 08:16 UTCby InfraStack Analyst–FIX 3.2.3 MEDIUM6.5WP2LEADS WordPress plugin: SQL injection lets subscribers read database contentsPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO MEDIUM4.3WordPress Perfect Images plugin lets authors replace files they do not ownPackage2026-10-31 08:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in local-commander-agent (npm)local-commander-agentPackage2026-10-31 07:57 UTCby osv-malicious–UNINSTALL MEDIUM5.3WordPress Seraphinite Accelerator plugin exposes user records through cache filesPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO CRITICAL9.1Popup Builder WordPress plugin: unauthenticated request trashes all published popupsPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.1WordPress WooCommerce product filter plugin: reflected cross-site scripting via wpf_fidPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO HIGH7.5WordPress Mail Logging plugin exposes admin password-reset keys to subscribersPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.4W3 Total Cache WordPress plugin: stored XSS via comment parameterPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.3WooCommerce Product Filter plugin: unauthenticated users can list unpublished productsPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.5WordPress UsersWP plugin: predictable password lets anyone log into dummy accountsPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Welcart e-Commerce plugin lets visitors take over any shop member accountPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO HIGH7.5FunnelKit Automations WordPress plugin: unauthenticated SQL injection exposes database dataFunnelKit Automations (wp-marketing-automations)Package2026-10-31 07:16 UTCby InfraStack Analyst–FIX 3.8.6 HIGH7.2WordPress User Submitted Posts plugin: stored script injection via front-end formPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO HIGH7.2ThirstyAffiliates WordPress plugin: stored script injection via commentsthirstyaffiliatesPackage2026-10-31 07:16 UTCby InfraStack Analyst–FIX 3.12.2 HIGH7.2WordPress WooCommerce shipping plugin: stored XSS runs in admin order viewPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO HIGH7.2Welcart e-Commerce WordPress plugin: stored XSS via gid parameterPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO CRITICAL9.1WP Booking System plugin: any logged-in subscriber can delete calendar noteswp-booking-systemPackage2026-10-31 07:16 UTCby InfraStack Analyst–FIX 2.1.0.6 HIGH7.2VikRentCar WordPress plugin: stored script injection via optionals parameterPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4WP Job Portal WordPress plugin: stored XSS via degreetitle parameterPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO HIGH7.2Relevanssi WordPress plugin: stored script injection via comment fieldPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO HIGH7.2WordPress VikRentCar plugin: unauthenticated stored XSS through poplink parameterPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO HIGH7.2W3 Total Cache WordPress plugin: stored XSS via comment parameterPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.1WordPress Webmention plugin: unsanitized og:title enables stored cross-site scriptingPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.4WordPress Photo Reviews plugin lets anyone delete media library filesPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Hustle WordPress plugin lets authenticated users overwrite email integration keysPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO CRITICAL9.8WordPress PDF Invoice plugin: unauthenticated checkout field lets attackers run codepdf-for-woocommercePackage2026-10-31 07:16 UTCby InfraStack Analyst–FIX 7.2.0 MEDIUM5.3WooCommerce PDF Invoices plugin: unauthenticated users can extract other customers' invoicesPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Discussion Board WordPress plugin: profile website field enables stored script injectionPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO HIGH7.2WooCommerce PDF Invoices plugin: stored XSS via billing fieldsPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO HIGH7.2SureCart WordPress plugin: unauthenticated stored XSS through comment parameterPackage2026-10-31 07:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTCloudflare: Cache purge delays in Qingdao Shandong, ChinaCloudflareVendor2026-10-31 06:41 UTCby status page–WHAT TO DO HIGHNOT SCOREDPayable Payment Gateway for WooCommerce: forged payment notices change order statusPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5Spectra WordPress plugin: unauthenticated attackers can delete theme filesPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWordPress Quick Event Manager plugin leaks draft and private posts to anonymous visitorsPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO HIGH8.1EXPLOITEDWordPress Core: predictable upgrade paths let attackers run code on the serverWordPress2 talkingRuntime2026-10-31 06:16 UTCby InfraStack Analyst2talkingFIX 7.1.4 HIGHNOT SCOREDMapster WP Maps WordPress plugin: unauthenticated REST route overwrites posts and settingsPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWordPress video gallery plugin leaks private and draft videos by IDPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDFirelight Lightbox WordPress plugin: image attributes let contributors inject scriptsPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDBuddyForms WordPress plugin lets anyone delete other visitors' uploaded filesPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDSecurity Optimizer WordPress plugin: unlimited two-factor code guesses allow account takeoverOther2026-10-31 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDPremium Packages WordPress plugin lets visitors set their own cart pricesPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWordPress Bulk Media Register: Author users can move arbitrary server filesPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.4NextGEN Gallery WordPress plugin: stored XSS via comment parameterPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO HIGH7.2PPWP Password Protect Pages WordPress plugin: unauthenticated stored XSS via commentsPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWordPress Essential Addons for Elementor: registration can grant Editor rolePackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWordPress Paystack payment plugin exposes live and test secret keys to contributorsPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO HIGH7.2Ninja Forms WordPress plugin: unauthenticated stored cross-site scripting via form submissionsPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO HIGH7.2WordPress Meow Lightbox plugin: stored XSS via bbPress repliesmeow-lightboxPackage2026-10-31 06:16 UTCby InfraStack Analyst–FIX 5.6.5 MEDIUM5.4WordPress Ninja Forms: subscribers can run arbitrary shortcodes on pagesPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5Ninja Forms WordPress plugin: unauthenticated attackers can run arbitrary shortcodesPackage2026-10-31 06:16 UTCby EPSS–WHAT TO DO HIGH7.4SoftIron HyperCloud: authenticated users can run OS commands on hypervisor hostsInfrastructure2026-10-31 02:17 UTCby EPSS–WHAT TO DO HIGH8.7Drupal File Force Download module lets anonymous users fetch protected filesPackage2026-10-31 01:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Drupal Field Collection: users can edit items on nodes they cannot accessPackage2026-10-31 00:16 UTCby EPSS–WHAT TO DO CRITICAL9.3Elixir Assent: Sign in with Apple callback lets attackers impersonate other usersPackage2026-10-30 23:51 UTCby EPSS–WHAT TO DO

Friday, Oct 30Saturday, Oct 31Sunday, Nov 1