Monthly
Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. Publicly available exploit code exists (reported by WPScan); the endpoints require no WordPress authentication and are gated only by a detached Ed25519 signature tied to the operator's hardcoded public key, so the operator retains privileged access indefinitely.
Unauthorized BLE command injection against the Pulsetto Vagus Nerve Stimulator firmware allows any physically proximate attacker to invoke hidden device commands without authentication or encryption, with potential to alter stimulation parameters or disrupt device operation. The firmware processes a set of undisclosed commands - never exposed through the official companion mobile application - whenever the device is powered on and advertising over BLE, presenting a zero-authentication attack surface at the radio layer. No public exploit code has been identified at time of analysis, but the adjacent-only, no-authentication requirement makes opportunistic abuse practical in any clinical or public setting where patients wear the device.
Supply-chain compromise of the Supsystic Pro WordPress plugin family delivered trojanized plugin updates from the vendor's own compromised update server, giving unauthenticated attackers a foothold on every site that pulled the poisoned release. The embedded malicious code fetches a second-stage payload that harvests credentials and other sensitive data and hands the operator full control of the affected WordPress site. Reported by WPScan; no public exploit is identified and the issue is not listed in CISA KEV at time of analysis, though the delivery mechanism means the implant is effectively pre-planted rather than requiring an active attack against each target.
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Supply-chain compromise of MonsterInsights Pro, a widely used WordPress Google Analytics plugin, delivered a malicious file (class-system-check.php) through the vendor's own S3 update bucket (monster-insights.s3.amazonaws.com). Both the current release (10.2.2) and the 10.2.0 build the vendor rolled back to are trojaned, so administrators who updated - or downgraded to remediate - received attacker-controlled PHP that runs with full site privileges. WPScan reports the attacker still holds write access to the bucket and was iterating on three AES-256-GCM payload variants on 2026-06-11; there is no CISA KEV listing and no public exploit code, but the malicious distribution is described as active and ongoing by the reporter.
Unauthenticated remote code execution in Puwell IP Camera firmware versions 2.x through 4.x lets remote attackers achieve root-level control by sending a crafted JSON payload to an undocumented DebugShell service listening on TCP port 34567. Because the service performs neither authentication nor input sanitization, any attacker with network reach to the port can pass operating-system commands directly to the device, resulting in full compromise. Reported by VulnCheck with publicly available exploit code exists; no public evidence of active in-the-wild exploitation (not in CISA KEV).
Credential exposure in the Vacron VIN-DS783E-E6 network video/surveillance device lets unauthenticated remote attackers invoke an undocumented hidden function that returns the device administrator credentials, per a TWCERT-coordinated disclosure. Recovering the admin login yields complete takeover of the appliance (login, configuration, and video streams). No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.
Full system compromise of WAGO System I/O-Field series controllers (0765-xxx families) is possible when an unauthenticated remote attacker reaches an undocumented internal diagnostic interface that is briefly exposed during the device's early boot phase. Because the diagnostic capability requires no authentication and grants access to internal system processes, a successful attacker obtains complete control over confidentiality, integrity, and availability. Reported by CERT@VDE (VDE-2026-031); no public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Undocumented persistent backdoor in Yarbo firmware v2.3.9 grants remote privileged access that survives factory reset and firmware updates. The backdoor requires high-privilege authentication (CVSS PR:H) but provides complete system control once accessed. No public exploit identified at time of analysis, though GitHub repository reference suggests technical disclosure exists. CVSS 7.2 reflects the high-privilege requirement, but persistence across resets and undocumented nature indicate significant supply chain or insider threat risk.
Remote unauthenticated attackers can trigger denial of service in Delta Electronics AS320T industrial automation devices by invoking an undocumented subfunction. The vulnerability allows network-accessible exploitation without credentials against default configurations, potentially disrupting critical industrial control operations. Delta Electronics confirmed the flaw in PCSA-2026-00006, grouped with three other CVEs affecting the same product line.
Full site compromise in the Link Factory WordPress plugin stems from the plugin itself being a deliberate backdoor rather than a coding flaw. Marketed as a 'homepage sentence publisher', it silently exposes an operator-controlled REST API under /wp-json/link-factory/v1/ that grants the plugin's author covert command-and-control over any site that installs it. Publicly available exploit code exists (reported by WPScan); the endpoints require no WordPress authentication and are gated only by a detached Ed25519 signature tied to the operator's hardcoded public key, so the operator retains privileged access indefinitely.
Unauthorized BLE command injection against the Pulsetto Vagus Nerve Stimulator firmware allows any physically proximate attacker to invoke hidden device commands without authentication or encryption, with potential to alter stimulation parameters or disrupt device operation. The firmware processes a set of undisclosed commands - never exposed through the official companion mobile application - whenever the device is powered on and advertising over BLE, presenting a zero-authentication attack surface at the radio layer. No public exploit code has been identified at time of analysis, but the adjacent-only, no-authentication requirement makes opportunistic abuse practical in any clinical or public setting where patients wear the device.
Supply-chain compromise of the Supsystic Pro WordPress plugin family delivered trojanized plugin updates from the vendor's own compromised update server, giving unauthenticated attackers a foothold on every site that pulled the poisoned release. The embedded malicious code fetches a second-stage payload that harvests credentials and other sensitive data and hands the operator full control of the affected WordPress site. Reported by WPScan; no public exploit is identified and the issue is not listed in CISA KEV at time of analysis, though the delivery mechanism means the implant is effectively pre-planted rather than requiring an active attack against each target.
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Supply-chain compromise of MonsterInsights Pro, a widely used WordPress Google Analytics plugin, delivered a malicious file (class-system-check.php) through the vendor's own S3 update bucket (monster-insights.s3.amazonaws.com). Both the current release (10.2.2) and the 10.2.0 build the vendor rolled back to are trojaned, so administrators who updated - or downgraded to remediate - received attacker-controlled PHP that runs with full site privileges. WPScan reports the attacker still holds write access to the bucket and was iterating on three AES-256-GCM payload variants on 2026-06-11; there is no CISA KEV listing and no public exploit code, but the malicious distribution is described as active and ongoing by the reporter.
Unauthenticated remote code execution in Puwell IP Camera firmware versions 2.x through 4.x lets remote attackers achieve root-level control by sending a crafted JSON payload to an undocumented DebugShell service listening on TCP port 34567. Because the service performs neither authentication nor input sanitization, any attacker with network reach to the port can pass operating-system commands directly to the device, resulting in full compromise. Reported by VulnCheck with publicly available exploit code exists; no public evidence of active in-the-wild exploitation (not in CISA KEV).
Credential exposure in the Vacron VIN-DS783E-E6 network video/surveillance device lets unauthenticated remote attackers invoke an undocumented hidden function that returns the device administrator credentials, per a TWCERT-coordinated disclosure. Recovering the admin login yields complete takeover of the appliance (login, configuration, and video streams). No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.
Full system compromise of WAGO System I/O-Field series controllers (0765-xxx families) is possible when an unauthenticated remote attacker reaches an undocumented internal diagnostic interface that is briefly exposed during the device's early boot phase. Because the diagnostic capability requires no authentication and grants access to internal system processes, a successful attacker obtains complete control over confidentiality, integrity, and availability. Reported by CERT@VDE (VDE-2026-031); no public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Undocumented persistent backdoor in Yarbo firmware v2.3.9 grants remote privileged access that survives factory reset and firmware updates. The backdoor requires high-privilege authentication (CVSS PR:H) but provides complete system control once accessed. No public exploit identified at time of analysis, though GitHub repository reference suggests technical disclosure exists. CVSS 7.2 reflects the high-privilege requirement, but persistence across resets and undocumented nature indicate significant supply chain or insider threat risk.
Remote unauthenticated attackers can trigger denial of service in Delta Electronics AS320T industrial automation devices by invoking an undocumented subfunction. The vulnerability allows network-accessible exploitation without credentials against default configurations, potentially disrupting critical industrial control operations. Delta Electronics confirmed the flaw in PCSA-2026-00006, grouped with three other CVEs affecting the same product line.