🧩 Forminator Upload-Record Flaw Enables Stored XSS
Operators running Forminator through version 1.56.1 should mitigate immediately and install a vendor-provided patched release when available. Prioritize internet-facing WordPress sites because exploitation requires no authentication, and review forms for suspicious upload records.
CVE-2026-18325 is a stored cross-site scripting vulnerability in the Forminator Forms WordPress plugin through version 1.56.1. Unauthenticated attackers can forge an upload field record containing a malicious file_url value, causing arbitrary scripts to execute when an affected page is viewed. The vulnerability is rated HIGH with CVSS 7.2.
🔗 Read more 🔗
Source: NVD
🗑️ File Manager Flaw Can Delete Server Files and Enable RCE
WordPress administrators using File Manager versions 6.0 through 6.9 should disable or restrict the plugin immediately and install a vendor-provided patched release when available. Review low-privilege accounts and server logs because subscriber access is sufficient for exploitation.
CVE-2026-15991 affects versions 6.0 through 6.9 of the File Manager plugin for WordPress. An authenticated attacker with subscriber-level access can bypass command permission handling to read or delete arbitrary server files, potentially enabling remote code execution by deleting a critical file such as wp-config.php. The vulnerability is rated HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
📁 NanoClaw Path Traversal Exploit Is Public
NanoClaw deployments through version 2.0.64 should be isolated or otherwise mitigated immediately, then updated when a vendor-provided fix becomes available. Treat exposed instances as urgent because exploit details are public and the vendor had not responded at publication time.
CVE-2026-18991 is a remotely exploitable path traversal vulnerability in the send_file component of nanocoai NanoClaw through version 2.0.64. The flaw affects container/agent-runner/src/mcp-tools/core.ts and may allow attackers to access paths outside the intended location. It is rated HIGH with CVSS 7.3, and the exploit has been publicly disclosed and may be used.
🔗 Read more 🔗
Source: NVD
🔓 LettaBot API Status Route Lacks Authentication
LettaBot 0.2.0 operators should remove the affected route from public access, add compensating authentication controls, and install a vendor-provided fix when available. Act urgently because exploitation information is public and the vendor had not responded.
CVE-2026-18990 is a missing-authentication vulnerability in the API Status Route of letta-ai LettaBot 0.2.0. A remote attacker may access the affected functionality without the intended authentication controls. The issue is rated HIGH with CVSS 7.3, and the exploit is public and may be used.
🔗 Read more 🔗
Source: NVD
🌐 Super Agent Party Proxy Route Exposes SSRF Flaw
Users should disable or restrict the extension_proxy route immediately, limit outbound network access, and install a vendor-provided fix when available. Public exploit availability and the lack of a vendor response make exposed deployments especially urgent.
CVE-2026-18973 is a server-side request forgery vulnerability in heshengtao super-agent-party through version 0.4.1. Improper handling of the url argument by sanitize_proxy_url in the extension_proxy route allows remote attackers to make unintended server-side requests. The vulnerability is rated HIGH with CVSS 7.3, and the exploit has been publicly disclosed and may be used.
🔗 Read more 🔗
Source: NVD
💥 open62541 Buffer Overflow Allows Remote Service Disruption
Organizations using open62541 1.5.5 should mitigate immediately, especially where OPC UA services are remotely reachable, and install a vendor-provided patched release when available. Restrict network access and monitor for malformed service calls or unexplained crashes.
CVE-2026-67869 is a buffer overflow vulnerability in open62541 version 1.5.5. A remote attacker can trigger the flaw through Service_Call input validation involving runtime-resolved InputArguments metadata, causing a denial of service. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🚨 FrontMCP Sandbox Escape Enables Unauthenticated RCE
Every FrontMCP deployment below 1.5.7 should be upgraded to version 1.5.7 or later immediately. Treat public or tool-enabled servers as potentially exposed, rotate accessible secrets after patching, and review logs for suspicious tools/call activity.
CVE-2026-67531 is a sandbox escape in FrontMCP versions before 1.5.7 that exposes live host Zod schema objects to sandboxed scripts. Attackers can reach the host Function constructor and execute arbitrary code as the server user with a single tools/call, potentially exposing credentials, session secrets, database access, and cloud metadata. Default public authentication settings can expose unconfigured servers to unauthenticated attacks, while prompt injection may trigger exploitation on authenticated systems. The vulnerability is rated CRITICAL with CVSS 9.3 and is fixed in version 1.5.7.
🔗 Read more 🔗
Source: NVD
📤 Rongzhitong Platform Allows Unrestricted File Uploads
Administrators should block or tightly restrict the affected upload endpoint immediately and install a vendor-provided fix when available. Investigate uploaded files and related activity because exploit details are public and the vendor had not responded.
CVE-2026-18969 is an unrestricted file upload vulnerability in Rongzhitong Visual Integrated Command and Dispatch Platform through version 20260617. A remote attacker can manipulate the File argument at /dm/dispatch/userinfo/upload to upload files without proper restrictions. The issue is rated HIGH with CVSS 7.3, and the exploit is public and may be used.
🔗 Read more 🔗
Source: NVD
✉️ FluentSMTP Email Logs Expose Administrators to Stored XSS
FluentSMTP users should mitigate immediately, avoid browsing untrusted email-log detail entries, and install a vendor-provided patched release when available. Review stored logs for unusual recipient display names because exploitation can be initiated without authentication.
CVE-2026-16636 is a stored cross-site scripting vulnerability in the FluentSMTP WordPress plugin through version 2.2.95. An unauthenticated attacker can place a malicious payload in a recipient display name that executes when an administrator views email-log details through the Prev or Next controls. The vulnerability is rated HIGH with CVSS 7.2.
🔗 Read more 🔗
Source: NVD
💉 Rongzhitong Dispatch Endpoint Vulnerable to SQL Injection
Operators should restrict the affected endpoint, deploy database and web-application firewall protections, and install a vendor-provided fix when available. Review database and application logs urgently because exploit details are public and the vendor had not responded.
CVE-2026-18970 is a SQL injection vulnerability in Rongzhitong Visual Integrated Command and Dispatch Platform through version 20260617. Remote attackers can manipulate the Name argument at /dm/dispatch/user/findAll to inject database queries. The vulnerability is rated HIGH with CVSS 7.3, and the exploit has been published and may be used.
🔗 Read more 🔗
Source: NVD
🧨 open62541 Use-After-Free Enables Remote DoS
Teams operating open62541 1.5.5 should mitigate immediately, particularly on remotely accessible OPC UA servers, and install a vendor-provided patched release when available. Limit network exposure and monitor for crashes involving subscriptions or MonitoredItem activity.
CVE-2026-67863 is a server-side use-after-free vulnerability in open62541 version 1.5.5. The flaw occurs when a local MonitoredItem callback deletes the current item while UA_Subscription_localPublish continues using its notification object. A remote attacker can exploit this condition to cause a denial of service, and the vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🧱 Malformed HDF5 Dataset Can Crash Applications
Applications that process untrusted HDF5 files should upgrade to HDF5 2.1.1 or later immediately. Until upgraded, sandbox file-processing workloads and reject malformed or externally supplied datasets where practical.
CVE-2026-19024 is a NULL pointer dereference in H5Pget_fill_value affecting HDF5 versions before 2.1.1. A crafted dataset with inconsistent fill-value metadata can pass a NULL datatype into H5T_path_find and cause a denial of service. The vulnerability is rated HIGH with CVSS 8.2.
🔗 Read more 🔗
Source: NVD