The WP Popular Posts WordPress plugin versions up to and including 7.4.2 have a vulnerability that allows unauthenticated attackers to access sensitive information from non-public post objects. This occurs because the plugin's REST API endpoint improperly permits access without proper permission checks, exposing fields such as raw title, content body, password, meta, status, and guid. The vulnerability arises from the 'context' parameter being passed directly to WordPress core functions without enforcing access controls.
CVE-2026-103536 is a medium-severity vulnerability in ZongXR Supermarket version 1.0.0.0. It affects the OrderController.addOrder function, where manipulation of the userId argument leads to missing authentication. This flaw allows remote attackers to potentially bypass authentication controls. The vulnerability is publicly known and exploit code is available, but there is no vendor response or patch at this time.
CVE-2026-103641 is an out-of-bounds read vulnerability in the GEGL Radiance HDR loader used in Red Hat Enterprise Linux 10. The flaw occurs when an uncompressed scanline in an HDR image is shorter than the width declared in the file header, causing the loader to read past the end of a memory-mapped image. This can lead to a crash of the application that uses the loader when opening a crafted HDR file.
CVE-2026-103534 is a medium severity vulnerability in David-Crty databasement versions 1.7.0 and 1.7.1. It involves improper access controls in the SnapshotPolicy.viewAny and SnapshotPolicy.view functions within the Snapshot Model component, specifically in the /api/v1/snapshots endpoint. This flaw allows remote attackers to bypass intended access restrictions. The issue is fixed in version 1.7.2.
Simply Schedule Appointments WordPress plugin versions up to 1.6.12.31 contain an authorization bypass vulnerability via the 'complete_group' parameter. Authenticated users with subscriber-level access or higher can exploit missing validation on a user-controlled key to access private appointment tokens and personally identifiable information (PII) of co-bookers. Attackers can then use leaked tokens to read, modify, or cancel appointments of other users within the same group booking.
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; final_checks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; run_advisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwai_advisor_data option with no schema validation or HTML sanitization, and advisor_metabox() concatenates the resulting 'title' and 'description' values directly into the WordPress dashboard widget without esc_html(), wp_kses(), or equivalent escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the WordPress dashboard.
The Simply Schedule Appointments WordPress plugin up to version 1.6.12.32 has a missing authorization vulnerability via the 'recursive' parameter. This allows unauthenticated attackers to access sensitive customer information including names, emails, phone numbers, and custom form data. Additionally, attackers can obtain per-appointment public_token values that enable deletion of arbitrary appointments without authentication.
BlueALSA's bluez-alsa/bluealsad component contains a division-by-zero vulnerability in the LC3plus sink decoder. This flaw allows a Bluetooth-adjacent attacker to cause a denial of service by sending a crafted RTP media header with a zero frame count. The vulnerability triggers a crash in the decoding thread, affecting builds compiled with LC3plus support enabled.
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schema_name results in path traversal. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 1.7.2 will fix this issue. You should upgrade the affected component.
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=<id>-<raw_token>` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber's permanent raw authentication cookie, which they can then use to export the subscriber's full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber's stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site's relink key rotates, meaning that any party who observes such a URL — through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy set — can replay it indefinitely to obtain the victim's credential.
CVE-2026-13313 is a high-severity vulnerability in certain ASUS router models involving active debug code. It allows a remote authenticated user to bypass security controls via a crafted HTTP request, enabling the Telnet service. This leads to arbitrary command execution with root privileges on the affected router, potentially impacting other devices connected to it. The vulnerability is identified as CWE-489 (Active Debug Code). No specific affected versions or patch information are provided in the available data.
CVE-2026-14157 is a critical vulnerability in ASUS Router modules involving the use of an externally controlled format string. This flaw allows a remote authenticated user to execute arbitrary commands by uploading a specially crafted file via the router's web management interface. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact. No specific affected versions or patches have been provided in the available data.
CVE-2026-93495 is a high-severity vulnerability in the ASUS PRIME Z390-A motherboard involving improper initialization. This flaw allows a physically proximate attacker to read or write arbitrary memory by connecting a specially crafted device. The vulnerability does not require user interaction or privileges but does require physical proximity. No specific affected versions or patch information is provided in the available data.
The provided content is a daily update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Thursday, October 1st, 2026.' It appears to be a general security news bulletin without specific details about any new vulnerabilities, exploits, or active threats.
Alter Zero is an open-source AI coding agent written in Rust that operates within the terminal to assist with coding, debugging, cybersecurity research, and automation tasks. It integrates with various AI model providers and offers a native terminal experience with live command output and readable diffs. The project is available on GitHub and supports Linux and macOS platforms. There is no indication of any security vulnerability or threat associated with Alter Zero in the provided information.
CVE-2026-103532 is a medium severity vulnerability in immich-app Immich versions 2.7.0 through 2.7.5. It involves improper authorization in the checkSharedLinkAccess function of the Shared Link Preview Handler component. The flaw arises from manipulation of the Password argument, allowing remote attackers to bypass authorization checks. The issue was reported and marked as a duplicate in the associated GitHub issue. No official patch or remediation details are provided.
CVE-2026-103531 is a medium severity stack-based buffer overflow vulnerability in OpenSC versions 0.27.0 and 0.27.1. The flaw exists in the function setcos_construct_fci_44 within src/libopensc/card-setcos.c. An attacker can remotely trigger this vulnerability by manipulating the argument type_attr, potentially causing a buffer overflow on the stack. A patch identified by commit ad730304052937c32b4eb489a06835ac6123632c is available to address this issue.
DeepTutor version 1.4.0 has an authorization bypass vulnerability in its book confirmation flow. This flaw allows unauthenticated or unauthorized users to reuse a publicly exposed book_id to submit confirm-proposal requests for existing books. Exploitation results in unauthorized overwrites of persisted metadata and spine content. The vulnerability has a critical severity with a CVSS score of 9.1. No patch or remediation information is currently provided.
Devika version 1.0 contains a path traversal vulnerability in the Feature Agent's save_code_to_project function. This flaw allows attackers to write files outside the intended project workspace, which could lead to full server compromise. The vulnerability is identified as CVE-2026-51875 and has a critical severity rating with a CVSS score of 9.1.
CVE-2026-51874 is a path traversal vulnerability in Devika v1.0's Patcher Agent save_code_to_project function. This flaw allows attackers to write files outside the intended project workspace, potentially leading to unauthorized file modification. The vulnerability has a high severity with a CVSS score of 7.5. No patch or remediation information is currently provided.