Threat database

This content describes an open-source cybersecurity project called Vader-Pro-VDR, which is an AI-assisted vulnerability detection and remediation platform. The project includes a Go-based endpoint agent for system inventory collection and a Python FastAPI backend for processing and storing telemetry data. It features secure, encrypted data transmission and a modular API design. The post is a request for advice on growing the project and attracting contributors, not a report of a security vulnerability or threat.

CVE-2026-111942 is a cross-site scripting (XSS) vulnerability in hrisikeshpal Blood_Bank_Management_System version 1.0.0. The vulnerability exists in an unknown function within the /abs.php file, where manipulation of the Search argument allows remote attackers to inject malicious scripts. The exploit code has been publicly disclosed, but there is no vendor response or patch available yet. The CVSS 4.0 score is 5.3, indicating a medium severity risk.

CVE-2026-96534 is a SQL injection vulnerability in the Modern Events Calendar Lite and Pro WordPress plugins before version 7.37.0. The flaw allows authenticated users with minimal privileges (Subscriber and above) to inject SQL code due to improper sanitization and escaping of a parameter used in SQL statements.

A missing authorization vulnerability in the AI Engine WordPress plugin before version 3.7.9 allows users with Editor role or higher to modify or change the type of arbitrary posts on the site, including those they are not permitted to edit.

A Cross-Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin before version 9.2.11.002. The flaw arises because the plugin does not properly escape a category navigation value before reflecting it into a JavaScript event handler on gallery breadcrumb links. This allows unauthenticated attackers to inject arbitrary scripts that execute in the browser of anyone who clicks the crafted breadcrumb link, including logged-in administrators.

The AI Engine WordPress plugin versions before 3.7.9 contain a missing authorization vulnerability that allows users with Editor role and above to delete arbitrary posts, including those they normally cannot delete such as navigation menus, block templates, and global styles. This occurs because the plugin does not verify ownership of the media item before converting and deleting it.

A vulnerability in the Modern Events Calendar Lite WordPress plugin before version 7.36.4 allows authenticated users with the Subscriber role to update the title, content, and excerpt of posts, pages, and custom post types created by other users without proper authorization checks.

A vulnerability in the Modern Events Calendar Lite WordPress plugin before version 7.37.0 allows any authenticated user, including those with minimal privileges such as Subscribers, to access sensitive event booking and attendee information. This includes names, email addresses, transaction IDs, and payment amounts. The issue arises because the plugin does not perform proper capability, nonce, or ownership checks before disclosing this data.

The Salon Booking System WordPress plugin versions before 10.31.11 have an improper access control vulnerability in one of their REST API endpoints. This flaw allows any authenticated user, including low-privileged roles like subscribers, to access all discount coupons configured on the site. The exposed information includes coupons that administrators intended to hide from customers, along with details such as amounts, validity dates, and usage limits.

CVE-2026-110033 is a cross-site scripting (XSS) vulnerability in the Salon Booking System WordPress plugin versions before 10.31.11. It allows users with the Salon Staff role or higher to supply an image URL that the server fetches and writes to a public location under an attacker-chosen filename. This can lead to disclosure of internal-only resources and storage of malicious SVG files that execute arbitrary scripts in the site's origin.

The Salon Booking System WordPress plugin before version 10.31.11 contains an authorization flaw that allows users with Salon Staff or Salon Worker roles to modify other user accounts. This includes resetting any user's role, even administrators, to a customer and overwriting profile fields, which can lead to loss of administrative access and potential site lockout.

CVE-2026-110031 is a privilege escalation vulnerability in the Salon Booking System WordPress plugin versions from 10.17 up to but not including 10.31.11. It allows users with the custom salon staff role to assign arbitrary capabilities to other accounts when editing a customer, enabling escalation to administrator privileges and full site takeover.

Tasty Recipes Lite WordPress plugin versions from 1.2 up to but not including 1.2.11 have a missing authorization vulnerability. This flaw allows users with Contributor-level roles to create, rename, and delete taxonomy terms such as categories, tags, and navigation menus without proper capability checks.

CVE-2026-109937 is an open redirect vulnerability in the Otter Blocks WordPress plugin versions before 3.2.3. The plugin fails to validate that a user-supplied return URL belongs to the site when building the return destination of a Stripe Checkout session. This allows unauthenticated attackers to redirect users who complete or cancel checkout to arbitrary external URLs.

CVE-2026-87844 is a vulnerability in the PickPlugins Product Designer for WooCommerce WordPress plugin up to version 1.0.40. The plugin fails to perform proper capability checks and has an inverted nonce verification mechanism, which accepts requests with invalid or missing nonces while rejecting valid ones. Additionally, it does not validate the post to which data is written, allowing unauthenticated users to insert design template data into the metadata of any post on the site. This can lead to unauthorized modification of post metadata.

A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.

CVE-2026-111876 is a command injection vulnerability in the alexpasmantier television software up to version 0.15.9. The flaw exists in the Entry::output function within the television/channels/entry.rs file. Exploitation requires local access and involves manipulating the 'raw' argument to execute arbitrary commands. The issue was reported but the related GitHub issue was closed as 'not planned' for a fix. The vulnerability has a medium severity with a CVSS 4.8 score.

CVE-2026-111875 is a medium severity vulnerability in David-Crty Databasement versions 1.8.0 and 1.8.1. It involves missing authorization in the Scheduled Restore component, specifically in the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php. The vulnerability allows remote attackers to manipulate the argument schema_name to bypass authorization controls. The issue is fixed in version 1.8.2.

CVE Intel is an open-source tool that aggregates multiple public vulnerability intelligence sources such as NVD, CISA KEV, EPSS, and OSV into a single risk score and prioritization recommendation. It supports querying CVEs, IPs, file hashes, and dependencies, providing a risk score from 0 to 100 and an urgency indicator for patching. The tool includes a local AI model for explaining findings and can be used as a desktop app, CLI, REST API, or MCP server for AI coding assistants. It does not scan or fix vulnerabilities but helps security teams prioritize patching efforts based on consolidated threat intelligence.