The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
The Prime Mover – Backup and Migration WordPress plugin (versions up to 2.2.1) is vulnerable to PHP Object Injection via unsafe deserialization of untrusted input stored in comment content. An unauthenticated attacker can submit a crafted base64-encoded serialized object through the comment submission endpoint, which is later unserialized without restrictions during plugin export or restore operations. This leads to a critical remote code execution risk without requiring additional plugins or themes.
The User Profile Builder plugin for WordPress up to version 4.0.3 contains a privilege escalation vulnerability. Authenticated users with Author-level access or higher can assign themselves or others privileged roles such as Editor via the Gutenberg Register block due to improper server-side authorization. The vulnerability arises because the plugin does not adequately restrict role assignment for roles lacking certain high-level capabilities, allowing unauthorized role elevation.
A malicious file identified by the SHA-256 hash b5149190ab5cdfcee95c4aa201bdd0229f426d3bbf6d2cd45d0e983f120b94b7 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was seen 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash d5d4249912afc83472420ec77c8a97081800436df1e31d14bb814649e084e061 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The threat is an indicator of compromise (IOC) rather than a vulnerability or exploit itself. No known exploits or threat actors are associated with this hash, and no affected software versions or countries are specified.
The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash ef251d66663f4a97882fcdcf7622a377c2b3068c26763f73e1ec0a81136342dc. This file was observed 10 times on October 24, 2026, associated with attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The hash corresponds to a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The threat is an indicator of compromise (IOC) useful for detection and response efforts.
A malicious file identified by the SHA-256 hash 31087290fc269af7921f9591418ac5d0baff3304bc3a18bc7b614546766586e9 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information on affected software versions or known exploits in the wild. The file hash serves as an indicator of compromise (IOC) to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 792a633371540ee9695ed6923f566de4a41cdaec6883e5b537d8ef848ee8636e was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or geographic targeting are indicated. No known exploits in the wild or threat actors are associated with this indicator at this time.
A malicious file identified by the SHA-256 hash 0616c20dea0ff2bd59fff5b60b3e907231d8c99296d0a0c719ba553f83dbd056 was observed 10 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is provided.
A malicious file identified by the SHA-256 hash 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 was observed 9 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations should match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
In October 2026, critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered in PHP affecting multiple supported versions. These vulnerabilities allow unauthenticated attackers to execute code remotely due to out-of-memory corruption and stale global state issues. Emergency security updates were released on October 21, 2026, for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Mitigations exist but are incomplete; updating to the fixed versions is strongly recommended. Additional incidents involving LiteLLM, eMudhra, GitLab, Railway, and Zeabur were also reported in the same timeframe. The PHP project continues to address these issues with further advisories and release candidates.
CVE-2026-115929 is a high-severity vulnerability in MongoDB Compass caused by improper certificate validation due to the inclusion of recoverable eMudhra intermediate CA certificates in the Electron runtime's TLS root certificate store. This issue is resolved by updating to Compass version 1.53.1, which includes Electron 44.9.1.
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.
One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.