CTX Feed Pro WordPress plugin versions up to and including 7.6.12 contain a code injection vulnerability due to improper input validation on the 'Feed Config' field. This field is passed directly to the eval() function, allowing authenticated users with Administrator-level privileges or higher to execute arbitrary PHP code on the server. The vulnerability has a high severity rating with a CVSS score of 7.2.
Divi Membership plugin for WordPress versions up to 2.3.0 contains an authentication bypass vulnerability. The vulnerability arises from the process_paypal_callback function accepting a base64-encoded paypal_param GET parameter without proper validation or verification. This allows unauthenticated attackers to impersonate any WordPress user, including administrators, by supplying an arbitrary user ID. The vulnerability leads to full site takeover. The PayPal gateway class is always instantiated, making the vulnerable code active on every front-end request.
The npm package 'kartykgithub-ph-f' version 1.0.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.
The Visitor Traffic Real Time Statistics Pro WordPress plugin up to version 11.22 is vulnerable to an unauthenticated stored Cross-Site Scripting (XSS) flaw via the page_title parameter in an AJAX action. This allows attackers to inject malicious scripts that execute in the administrator's browser when viewing the plugin dashboard.
DevKit Pro plugin for WordPress versions up to and including 2.3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to take over administrator accounts. The flaw arises because the plugin trusts an attacker-controlled cookie to identify privileged users and incorrectly verifies capabilities on that user instead of the actual requester. This enables attackers to obtain a valid nonce and escalate privileges to full administrator access, leading to complete site takeover.
A SQL injection vulnerability exists in itsourcecode Pet Shop Management System 1.0 in the admin_reject_completed.php file due to improper handling of the ID argument. This vulnerability can be exploited remotely and has been publicly disclosed. It has a CVSS score of 6.3, indicating medium severity. No patch or remediation information is currently available.
A server-side request forgery (SSRF) vulnerability exists in the fetch_url function of the mcp_server_fetch/server.py component in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to version 2026.6.4. This vulnerability allows remote attackers to manipulate URL or path arguments, potentially causing the server to make unintended requests. The vulnerability has a CVSS 3.1 score of 7.3, indicating medium severity. A fix has been proposed but is not yet accepted or available.
This is a write-up describing the experience of granting an AI agent real access to a personal homelab environment. The author explores the implications and outcomes of allowing an AI agent to perform actual write operations within a Kubernetes-based homelab setup. The content is experiential and observational rather than describing a specific vulnerability or exploit.
A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-104054 is a medium severity vulnerability in calcom cal.diy versions 6.0, 6.1, and 6.2.0. It involves missing authorization in the doesUserIdHaveAccessToBooking function within the PBAC Permission Engine component. The flaw can be exploited remotely without user interaction. Although exploit code is publicly available, no official fix has yet been accepted.
This entry is a daily update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Friday, October 2nd, 2026.' It provides general information and links related to security topics and classes but does not contain any specific security threat, vulnerability, or incident details.
RemusStealer is a malware-as-a-service program exhibiting multiple similarities to LummaStealer, including anti-virtual machine checks, credential theft tactics, and Application-Bound Encryption bypass methods. A key distinction is RemusStealer's use of Ethereum smart contracts for C2 communications instead of Steam or Telegram dead drop resolvers. Written in Go, the stealer performs extensive system discovery, gathering information about antivirus products, hardware specifications, and operating systems. It employs hidden desktop environments to evade detection while launching Microsoft Edge and Brave browser processes on non-primary window stations to steal credential files. The malware establishes connections to suspicious domains ending in .shop or .biz and communicates with Ethereum-related infrastructure. This evolution demonstrates attackers' increasing sophistication in leveraging blockchain technology to masquerade malicious communications through smart contracts.
A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client) could cause affected clients to accept an unauthorized member into the end-to-end encrypted media session, compromising the confidentiality and integrity of audio and video.
Transmission of a sensitive key in the URL
over an unencrypted HTTP connection. The
request is sent over HTTP rather than HTTPS, meaning the key is transmitted in
plaintext across the network. An attacker with the ability to monitor network
traffic could intercept the request and obtain the key
CVE-2026-103097 is a high-severity vulnerability in GeoVision Inc.'s GV-Eye Android application version 3.6.0. The issue involves a hardcoded API key embedded within the application package, which can be extracted through reverse engineering. This exposure allows unauthorized users to misuse the API key, potentially leading to unauthorized access to services relying on this key. The vulnerability does not affect confidentiality of user data directly but compromises the security of the API key itself.
CVE-2026-103096 is a vulnerability in GeoVision Inc.'s GV-Eye Android application version 3.6.0 where an API key is hardcoded and can be extracted from the application package. Because Android apps can be reverse engineered, this allows unauthorized users to retrieve and misuse the embedded API key. The vulnerability has a high severity with a CVSS score of 7.5, indicating a network attack vector with no privileges or user interaction required and high confidentiality impact. No official patch or remediation guidance is currently provided by the vendor. Users should check for vendor advisories for updates and avoid distributing the vulnerable version until a fix is available.
CVE-2026-67989 is a high-severity vulnerability involving a polynomial-time regular expression denial-of-service (ReDoS) condition in the Mistral model capability matching component of crmne/ruby_llm when used with Ruby 3.1.x. This vulnerability can cause denial of service by exhausting CPU resources during regex processing. No specific affected versions or patches are currently provided.
agentscope version 1.0.20 and earlier contains a critical code injection vulnerability in the execute_shell_command function. This flaw allows an attacker to execute arbitrary code or commands if they can reach the vulnerable entry point. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed.