🚨 Hardcoded Backdoor Exposes WordPress Sites to Admin Takeover
Immediately remove or update version 10.8.7, audit administrator accounts and plugin files, and investigate affected sites for compromise. The apparent supply-chain backdoor makes this an emergency even though the entry does not explicitly confirm widespread active exploitation.
CVE-2026-18072 is a CRITICAL authentication-bypass vulnerability in version 10.8.7 of the Advanced Responsive Video Embedder plugin for WordPress, with CVSS 9.8. A hardcoded backdoor token can let an unauthenticated attacker impersonate any existing administrator and gain full control of the site. The backdoor was likely introduced after an attacker gained access to the developer’s account.
🔗 Read more 🔗
Source: NVD
📤 Easy Digital Downloads Upload Flaw Could Enable Code Execution
WordPress operators using Easy Digital Downloads should patch promptly, especially where Shop Manager accounts are shared or not fully trusted. Review the uploads/edd/exports directory for unexpected executable files.
CVE-2026-12476 is a HIGH-severity arbitrary-file-upload vulnerability affecting Easy Digital Downloads for WordPress through version 3.6.9, with CVSS 7.2. Insufficient server-side file validation lets authenticated Shop Manager-level users or higher upload files with arbitrary extensions into a web-accessible directory. Successful abuse may lead to remote code execution.
🔗 Read more 🔗
Source: NVD
⬆️ WooCommerce Wholesale Plugin Lets Authors Become Administrators
Patch immediately on sites that permit author accounts, wholesale registrations, or other lower-privileged users. Audit recent role changes and administrator accounts for unauthorized privilege escalation.
CVE-2026-12144 is a HIGH-severity privilege-escalation flaw in Wholesale for WooCommerce through version 2.0.5, with CVSS 8.8. An authenticated attacker with author-level access can submit the administrator role because the plugin lacks capability checks and an allowlist for permitted roles. The required nonce may be accessible to authors who created a wholesale-request post.
🔗 Read more 🔗
Source: NVD
🔐 Netty OCSP Race Can Leak Data to Revoked Servers
Teams using Netty’s OcspServerCertificateValidator should upgrade promptly, particularly for clients handling credentials, tokens, or confidential requests. Prioritize internet-facing and security-sensitive integrations.
CVE-2026-56822 is a HIGH-severity Netty vulnerability with CVSS 7.4 affecting versions before 4.1.136.Final and 4.2.16.Final. The OcspServerCertificateValidator reports TLS handshake completion before asynchronous OCSP validation finishes, allowing applications to send sensitive data before discovering that a server certificate is revoked. The issue is fixed in 4.1.136.Final and 4.2.16.Final.
🔗 Read more 🔗
Source: NVD
🪪 Netty Accepts Replayed Expired OCSP Responses
Upgrade affected Netty applications promptly wherever OCSP validation is relied on for trust decisions. Systems operating across untrusted networks or processing sensitive traffic deserve the highest priority.
CVE-2026-56821 is a HIGH-severity certificate-revocation-bypass vulnerability in Netty, with CVSS 7.4. Before versions 4.1.136.Final and 4.2.16.Final, OcspServerCertificateValidator could treat an expired GOOD response as valid, enabling an on-path attacker to replay stale OCSP data for a since-revoked certificate. The flaw is fixed in 4.1.136.Final and 4.2.16.Final.
🔗 Read more 🔗
Source: NVD
🗂️ goshs WebDAV MOVE Bypasses No-Delete Protection
Anyone exposing goshs WebDAV should upgrade to 2.1.4 immediately and inspect file integrity and logs for unexpected MOVE operations. Treat deployments relying on ‘–no-delete’ as potentially exposed.
CVE-2026-64863 is a CRITICAL WebDAV authorization flaw in goshs before version 2.1.4, with CVSS 9.1. The server treated MOVE as write-only and failed to enforce the ‘–no-delete’ setting, allowing clients to delete or overwrite files by using MOVE with ‘Overwrite: T’. Version 2.1.4 fixes the issue.
🔗 Read more 🔗
Source: NVD
🔓 goshs SFTP Configuration Can Allow Passwordless File Access
Upgrade goshs SFTP deployments to 2.1.4 immediately, especially those using an empty-password configuration. Review access logs and exposed files because affected instances may have allowed unauthenticated access.
CVE-2026-62325 is a CRITICAL authentication flaw in goshs from version 2.1.3 until 2.1.4, with CVSS 9.1. Running the server with an empty password configuration such as ‘-b admin:’ alongside SFTP and without ‘-fkf’ could leave authentication handlers unset, permitting unauthenticated file access. The issue is fixed in version 2.1.4.
🔗 Read more 🔗
Source: NVD
📦 goshs Bulk ZIP Downloads Bypass Folder Access Controls
Upgrade any older goshs deployment immediately and check whether bulk-download endpoints were exposed publicly. Because this bypasses configured protections, assume supposedly restricted files may have been accessible.
CVE-2026-54719 is a HIGH-severity access-control vulnerability in goshs before version 2.1.1, with CVSS 7.5. The bulk ZIP download handler failed to apply folder ACLs, block lists, and custom authentication, allowing unauthenticated users to read protected files. The flaw is an incomplete fix for CVE-2026-40189 and is corrected in version 2.1.1.
🔗 Read more 🔗
Source: NVD
💉 Hypequery Escaping Bug Enables ClickHouse SQL Injection
Upgrade Hypequery to 2.0.2 immediately wherever untrusted input reaches query parameters. Review ClickHouse query logs and database permissions for signs or impact of injected statements.
CVE-2026-54658 is a CRITICAL SQL-injection vulnerability in Hypequery before version 2.0.2, with CVSS 9.8. Improper handling of backslashes before single quotes during parameter substitution lets attacker-controlled values escape their quoted context and inject arbitrary SQL into ClickHouse queries. Version 2.0.2 fixes the vulnerability.
🔗 Read more 🔗
Source: NVD
🕳️ openhole Proxy Flaw Enables Encoded Path Traversal
Upgrade public openhole servers to 0.1.2 immediately, particularly when they expose sensitive local admin panels or file-serving endpoints. Review proxy and backend logs for encoded traversal patterns such as ‘%2e’ and ‘%2f’.
CVE-2026-54650 is a HIGH-severity path-traversal vulnerability in openhole 0.1.1 and earlier, with CVSS 8.6. The public proxy failed to preserve the original escaped request path, allowing encoded dot segments and separators to reach tunneled localhost services as traversal sequences. The issue is fixed in version 0.1.2.
🔗 Read more 🔗
Source: NVD
💥 Malformed Telegram Packets Can Exhaust gotd/td Memory
Services using gotd/td on reachable network interfaces should upgrade promptly to 0.145.1. Prioritize always-on bots, gateways, and other deployments where process crashes or resource exhaustion would disrupt operations.
CVE-2026-54638 is a HIGH-severity denial-of-service vulnerability in the gotd/td Telegram MTProto client before version 0.145.1, with CVSS 7.5. An unauthenticated remote attacker can supply an excessive data length in an unencrypted MTProto packet, causing large memory allocations and heavy CPU or garbage-collection pressure. Version 0.145.1 fixes the issue.
🔗 Read more 🔗
Source: NVD