CVE-2026-41709 is a low-severity vulnerability in VMware ESXi that allows attackers with administrative privileges to perform certain operations without those actions being logged. This flaw reduces audit trail visibility, which can aid attackers in hiding their activities. The vulnerability was exploited as a zero-day by the China-linked threat actor Warp Panda in intrusions targeting US organizations, including law firms. VMware has released patches for ESXi versions 9.1.0.0-25370933, 9.0.2.0100-25595025, and 80U3j-25429389 and newer. The US Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and urges prompt patching.
CVE-2025-62841 is a high-severity vulnerability in QNAP Systems Inc.'s HBS 3 Hybrid Backup Sync and Hybrid Backup Sync products involving the use of hard-coded cryptographic keys. This flaw could allow remote attackers to compromise system security. The vulnerability has been fixed in versions 26.4.0.521 and later for HBS 3 Hybrid Backup Sync and versions 26.4.0.521 and 26.4.1.563 and later for Hybrid Backup Sync.
CVE-2025-62839 is a high-severity vulnerability in QNAP Systems Inc.'s HBS 3 Hybrid Backup Sync and Hybrid Backup Sync products caused by the use of a hard-coded cryptographic key. This flaw could allow remote attackers to compromise system security. The issue has been fixed in versions 26.4.0.521 and later for HBS 3 Hybrid Backup Sync, and 26.4.1.563 and later for Hybrid Backup Sync.
The Contact Form by Supsystic WordPress plugin versions prior to 1.11.1 contains an access control vulnerability in an AJAX action that deletes stored form statistics records. This flaw allows unauthenticated attackers to delete arbitrary statistics entries.
The LogixFast Auth WordPress plugin versions before 1.0.4 contain a vulnerability where the password-reset one-time code is sent to the email address provided in the reset request rather than the legitimate user's registered email. This flaw enables unauthenticated attackers to reset any user's password, including administrators, potentially leading to account takeover.
The Automated Import Products to Cart WordPress plugin versions before 1.0.4 improperly handle user-supplied file paths, allowing users with minimal permissions to read and delete arbitrary files on the server, including sensitive files such as those containing database credentials.
The Hide Price Until Login WordPress plugin versions before 1.1.2 contain a vulnerability where a guest-registration handler is not properly restricted. This flaw allows anyone to create a WordPress account and obtain a logged-in session even if the site's user-registration setting is disabled.
A vulnerability in the Two Factor Authentication and All-In-One Security (AIOS) WordPress plugins allows an attacker who knows a victim's password and has their own two-factor-enabled account to bypass the victim's second-factor authentication by using their own two-factor code, thereby obtaining the victim's session.
The Enable SVG, WebP, and ICO Upload WordPress plugin versions before 1.1.6 improperly handle uploaded SVG files that are not detected as SVG content. These files are stored and served as SVG images without proper sanitization, which could allow users with author-level permissions or higher to execute stored cross-site scripting (XSS) attacks.
An authorization bypass vulnerability exists in the /api/runscript functionality of FUXA version 1.3.2-2809. This flaw allows an attacker to execute privileged operations by sending a specially crafted unauthenticated HTTP request. The vulnerability has a medium severity rating with a CVSS score of 5.6.
The Social Web Suite WordPress plugin (up to version 4.1.12) contains a generic SQL Injection vulnerability via the 'exclude_posts' parameter. This flaw allows unauthenticated attackers to append arbitrary SQL queries to extract sensitive database information. The vulnerability is exacerbated by a bypassable HMAC authentication mechanism on fresh installations where the secret key is not yet generated.
An information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA version 1.3.2-2809. This flaw allows an unauthenticated attacker to send a specially crafted HTTP request that results in leaking information. The vulnerability has a medium severity rating with a CVSS score of 5.3.
The Wild Apricot Login plugin for WordPress up to version 1.0.18 has an authentication bypass vulnerability via SSO email-collision account binding. Attackers controlling a Wild Apricot contact with the same email as a WordPress administrator can authenticate as that admin without proof of account ownership. This allows obtaining a valid network-wide authentication cookie on WordPress Multisite networks, granting administrator access across subsites.
The SendPress Newsletters plugin for WordPress up to version 1.26.1.20 is vulnerable to a time-based SQL Injection via the 'subscriberid' parameter. This vulnerability arises from insufficient escaping of user input and inadequate preparation of SQL queries, allowing unauthenticated attackers to inject additional SQL commands. The nonce intended to protect the handler uses a hardcoded action value that is publicly accessible, effectively bypassing nonce-based access control.
An authorization bypass vulnerability exists in the /nodered functionality of FUXA version 1.3.2-2809. This flaw allows an attacker to send a specially crafted unauthenticated HTTP request that can lead to arbitrary code execution on the affected system. The vulnerability is critical with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
The Bot for Telegram on WooCommerce plugin for WordPress versions up to and including 1.3.0 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to forge bot updates and impersonate any WordPress user by exploiting a REST endpoint that lacks proper permission checks and signature verification. Attackers can obtain a login token and gain persistent authenticated sessions without credentials, potentially taking over administrator accounts.
The Community Events WordPress plugin versions from 1.4.9 up to but not including 1.6.0 contain a cross-site scripting (XSS) vulnerability. This flaw arises because the plugin does not perform authorization or nonce checks on public event submissions and fails to properly escape several submitted values before displaying them in the admin dashboard and public calendar. As a result, unauthenticated users can inject arbitrary scripts that execute in the browsers of administrators reviewing these submissions. The issue is fixed in version 1.6.0.
The Video Player for YouTube WordPress plugin versions before 2.1.4 have an improper access control vulnerability. Specifically, versions before 2.1.4 do not perform capability checks on the player-preset AJAX handler, allowing users with Contributor role and above to read the site-wide player-preset configuration. Versions before 2.1.1 also allow these users to modify and delete the configuration.