🔐 Hard-Coded Credentials Expose LB-LINK X-PRO
Operators running the affected LB-LINK X-PRO firmware should mitigate promptly, especially on internet-reachable devices. Because exploit code is public and the vendor did not respond to the disclosure, restrict remote exposure or disable affected services where operationally appropriate while monitoring for a vendor fix.
CVE-2026-19900 affects LB-LINK X-PRO 1.0.22-20231206 and involves hard-coded credentials associated with /etc/shadow that can be targeted remotely. Exploitation is considered difficult and requires high attack complexity, but a public exploit is available. The vulnerability is rated HIGH with CVSS 8.1.
🔗 Read more 🔗
Source: NVD
💉 SQL Injection Hits SourceCodester Timetabling System
Anyone running this SourceCodester application should mitigate quickly, particularly if it is externally accessible. Public exploit details lower the barrier for opportunistic attacks, so restrict exposure and apply a vendor fix when available.
CVE-2026-19899 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0, affecting /edit_teacher.php through manipulation of the ID argument. The flaw can be exploited remotely, and exploit details have been publicly disclosed. It is rated HIGH with CVSS 7.3.
🔗 Read more 🔗
Source: NVD
💾 Fastify Multipart Flaw Enables Persistent Disk Exhaustion
Fastify deployments using saveRequestFiles() should upgrade @fastify/multipart to 10.1.1 promptly. Internet-facing upload endpoints deserve particular attention because exploitation requires no authentication and can steadily exhaust disk space.
CVE-2026-19474 affects @fastify/multipart versions from 3.0.0 up to but not including 10.1.1. A client disconnect at a specific point during multipart processing can leave completed temporary files behind, allowing unauthenticated attackers to cause persistent linear disk consumption and denial of service. This incomplete-fix variant of CVE-2025-24033 is rated HIGH with CVSS 7.5 and is fixed in @fastify/multipart 10.1.1.
🔗 Read more 🔗
Source: NVD
🧨 Fastify Multipart Bug Can Exhaust Disk and Event Loop
Upgrade @fastify/multipart to 10.1.1 promptly on services accepting untrusted uploads. Public-facing systems are especially exposed because repeated unauthenticated requests can create persistent resource exhaustion.
CVE-2026-18549 affects @fastify/multipart versions from 5.3.0 up to but not including 10.1.1. An unauthenticated client can combine file-size truncation with a connection abort to leave temporary files and suspended request handlers behind, eventually exhausting disk space and event-loop resources. The flaw is rated HIGH with CVSS 7.5 and is fixed in @fastify/multipart 10.1.1.
🔗 Read more 🔗
Source: NVD
🔑 Fastify JWT Key Override Breaks Authorization Boundaries
Applications using different JWT keys for user, admin, tenant, or other trust domains should upgrade to 10.2.2 urgently. Review routes that pass a per-call verification key because affected deployments may have enforced weaker authorization boundaries than intended.
CVE-2026-18500 affects @fastify/jwt versions before 10.2.2. A globally configured secret can silently override a per-request verification key, allowing an authenticated user with a token signed by the global key to cross authorization domains that were intended to require a different key. The vulnerability is rated HIGH with CVSS 8.1 and is fixed in @fastify/jwt 10.2.2.
🔗 Read more 🔗
Source: NVD
🚨 Templately WordPress Plugin Allows Contributor-Level RCE
WordPress administrators using Templately through 3.7.1 should treat this as a high-priority exposure, especially on sites with untrusted Contributor accounts. Restrict or disable the affected cloud-import REST functionality where operationally appropriate and apply a vendor fix when available.
CVE-2026-18438 affects the Templately WordPress plugin through version 3.7.1 and can allow authenticated attackers with Contributor-level access or higher to achieve remote code execution. A filename validation and destination mismatch lets an attacker upload a GIF+PHP polyglot that is validated as an image but written to a .php destination, while weak REST API permission checks expose the required cloud-import functionality. The vulnerability is rated HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
👤 TrueBooker Flaw Enables Unauthenticated WordPress Account Takeover
Sites running TrueBooker 1.2.6 or earlier should mitigate immediately by disabling the plugin or otherwise preventing access to the vulnerable functionality where feasible. The flaw requires no authentication and can lead to full administrator takeover, so apply a vendor fix as soon as one is available.
CVE-2026-16142 affects the TrueBooker WordPress plugin through version 1.2.6. An unauthenticated AJAX handler accepts an arbitrary user ID and can change any account email address, including an administrator’s, after which the attacker can use the normal WordPress password-reset flow to take over the account. The vulnerability is rated CRITICAL with CVSS 9.8.
🔗 Read more 🔗
Source: NVD
⬆️ Real Estate Manager Pro Bug Lets Subscribers Become Admins
WordPress sites using affected Real Estate Manager Pro versions should restrict untrusted Subscriber access and mitigate the vulnerable functionality promptly. Successful exploitation provides Administrator privileges, so apply a vendor fix when available.
CVE-2026-15142 affects the Real Estate Manager Pro WordPress plugin through version 12.8.6. Improper capability handling can let an authenticated attacker with Subscriber-level access edit an administrator account and escalate to Administrator when the targeted user ID matches an existing media attachment ID. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🔥 User Profile Builder Bug Enables Full WordPress Admin Takeover
WordPress administrators running User Profile Builder 3.16.4 or earlier should mitigate immediately, including disabling affected registration functionality or the plugin itself where operationally appropriate. No authentication is required and successful exploitation results in full administrative takeover, so apply a vendor fix as soon as one is available.
CVE-2026-15826 affects the User Profile Builder WordPress plugin through version 3.16.4. A type-confusion flaw involving absint() and a WP_Error object can cause a failed registration with a specially sized username to produce an autologin nonce tied to user ID 1, allowing an unauthenticated attacker to log in as the site’s Administrator. The vulnerability is rated CRITICAL with CVSS 9.8.
🔗 Read more 🔗
Source: NVD
⬆️ Wholesale Market Plugin Can Promote Subscribers to Administrator
Sites using Wholesale Market 2.2.2 or earlier should disable the ‘Assigning requested role directly’ option and restrict untrusted subscriber access while affected. Apply a vendor fix when available because the vulnerable configuration can allow straightforward Administrator privilege escalation.
CVE-2026-14279 affects the Wholesale Market WordPress plugin through version 2.2.2. Its AJAX handler accepts a client-supplied role without an appropriate allowlist, enabling authenticated users with Subscriber-level access or higher to elevate themselves to Administrator when the site’s ‘Assigning requested role directly’ option is enabled. The vulnerability is rated HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
💉 AppFlowy qcuiknote SQL Injection Exposes Database Data
Organizations exposing AppFlowy’s qcuiknote feature to untrusted authenticated users should restrict access or disable the feature where feasible until remediation is available. The immediate concern is database confidentiality because attackers can extract data through arbitrary SQL injection.
CVE-2026-16007 is a SQL injection vulnerability in AppFlowy’s qcuiknote feature. Authenticated users with access to the feature can inject arbitrary SQL and exfiltrate information from the underlying SQL database. The vulnerability is rated HIGH with CVSS 7.1.
🔗 Read more 🔗
Source: NVD
💻 Semaphore Git URL Injection Leads to Server-Side RCE
Semaphore operators should upgrade to 2.18.20 or later quickly, especially where Manager or Owner roles are delegated broadly. Compromise reaches the server host itself, so affected instances should be treated as high-priority infrastructure exposure.
CVE-2026-73682 affects Semaphore versions prior to 2.18.20. Authenticated users with the Manager or Owner role on any project can abuse repository git_url handling and Git’s –upload-pack= option to inject shell commands, resulting in remote code execution on the Semaphore server host. The vulnerability is rated HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD