Daily vulnerability intelligence for defenders – fresh CVEs with exploitability signals, patch status, and action-oriented priorities from 22+ sources.

CVEs published

Get CVEs that hit your stack — not 200/day

Pick your technologies, get a weekly digest by email. Free, no spam.

React Python Postgres +200 more

React Next.js Python Postgres AWS +200 more

Trending Now See all

Critical Watch See all

Weekly Report See all

Actively Exploited Edge and Browser Flaws Anchor This Week's Risk Aug 31 – Sep 07, 2026

Web App RCE and Privilege Escalation Dominate; Zero KEV This Week Aug 24 – Aug 31, 2026

Actively Exploited RCE in Entra, MLflow, TrueConf Anchor This Week's Risk Aug 17 – Aug 24, 2026

Actively Exploited Unpatched RCE and Privilege Flaws Lead the Week Aug 10 – Aug 17, 2026

Weekly Vulnerability Briefing: Unpatched Critical RCE Dominates Findings Aug 03 – Aug 10, 2026

Actively Exploited KEVs and Widespread PoC-Available RCE Flaws Lead Week Jul 27 – Aug 03, 2026

Autel & Check Point Flaws Drive 1,096 Unpatched Critical/High Count Jul 20 – Jul 27, 2026

Actively Exploited SharePoint and SMA1000 Zero-Days Lead the Week Jul 13 – Jul 20, 2026

ICT Providers at Risk

View all

Last 30 days

Upcoming Zero-Day Disclosures 598 568 overdue

View all

to view ZDI disclosures

Attack Technique Trend

Prediction based on ZDI Disclosures & CVE data · 30 days

Analytics

Vendor Today – Quick Filter

Techniques

results

Sort:

Base Score

Vector String

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

Integrity (I)

Availability (A)

0 | 3.9| 6.9| 8.9| 10

NONE LOW MEDIUM HIGH CRITICAL

CVSS Filter – CVEs match

No CVEs match the selected criteria

Incoming 1

Pre-NVD – not yet scored

CVE-2026-3865 Kubernetes

ZDI Disclosures – Sep 17 10 5d

View all

MATE Desktop

Adobe

Cisco

Cisco

dnsmasq

Bosch Rexroth

GStreamer

Docker

Browse older vulnerabilities in Archive

Live Feed auto-refresh 60s

Vulnerability Intelligence — September 12, 2026

79 CVEs tracked today. 11 Critical, 20 High, 46 Medium, 2 Low.

CVE-2026-87719 CRITICAL CVSS 9.9
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Chat access to exfiltrate Advanced Search (Elasticsearch) instance configurations and stored credentials by supplying a specially crafted GraphQL subscription argument that bypasses serialization and forces an internal server object lookup. It affects EE 18.3 through 19.1.8, 19.2 through 19.2.6, and 19.3 through 19.3.2, was reported by GitLab, and publicly available exploit code exists (HackerOne #4012289). No CISA KEV listing at time of analysis, so this is POC-backed but not confirmed as actively exploited.

Deserialization Gitlab
CVE-2026-85706 CRITICAL CVSS 10.0
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the repository commits API, which fails to confine paths and does not enforce authentication. All 18.7 releases through 19.3.2 are affected across the fix lines (before 19.1.8, 19.2.6, and 19.3.2). This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, making it an emergency-patch priority for any internet-reachable GitLab instance.

Authentication Bypass Path Traversal Gitlab
CVE-2026-85681 CRITICAL CVSS 9.8
Unauthenticated site takeover in the WP Component WordPress plugin through version 2.2.4 stems from an AJAX-style action exposed to logged-out users that performs no capability or nonce validation and blindly writes an attacker-supplied option name and value. Because the handler can overwrite arbitrary wp_options entries, an attacker can flip 'users_can_register' on and set 'default_role' to administrator, then self-register an admin account. Reported by WPScan; carries CVSS 9.8 with EPSS 0.14% (3rd percentile) and no public exploit identified at time of analysis.

WordPress Privilege Escalation
CVE-2026-84171 CRITICAL CVSS 9.8
Unauthenticated remote code execution in the 'WP images upload on piclect' WordPress plugin (versions through 1.0) arises because the plugin writes uploaded files to a publicly accessible directory without validating the filename or MIME/content type. Any remote attacker can upload a PHP file and request it directly to run arbitrary code as the web server. Reported by WPScan with a maximal 9.8 CVSS; no public exploit code is identified at time of analysis and EPSS remains low at 0.16%.

WordPress RCE File Upload
CVE-2026-82845 CRITICAL CVSS 9.9
Remote code execution in the Masteriyo LMS WordPress plugin before 3.4.1 allows an attacker holding a minimal account (e.g. subscriber/student) to inject arbitrary PHP objects via user-supplied metadata that is unserialized on read-back, and to leverage a gadget class in a bundled library to write and execute arbitrary code on the server (CWE-502). A weaker unauthenticated variant of the same flaw yields arbitrary file write rather than full code execution. Publicly available exploit detail exists via WPScan; EPSS is low (0.17%, 6th percentile) and there is no public exploit identified as weaponized in the wild.

PHP WordPress RCE Deserialization
CVE-2026-81402 CRITICAL CVSS 9.8
Remote code execution in the DS Ad Rotator WordPress plugin (all versions through 0.8) allows unauthenticated attackers to upload arbitrary files, including PHP scripts, because the image upload handler enforces no capability check, no nonce verification, and no file-type validation. Any anonymous visitor can drop a web shell into a web-accessible directory and execute it for full server compromise. WPScan reports the flaw with a public advisory; no public exploit is identified at time of analysis and EPSS risk is low (0.20%), but the exploitation technique is trivial and well understood.

WordPress RCE File Upload
CVE-2026-78159 CRITICAL CVSS 9.8
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis, and the flaw is only reachable on sites that enable comments on tribe_events posts.

WordPress RCE Code Injection The Events Calendar Wordpress Plugin
CVE-2026-78006 CRITICAL CVSS 9.8
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6.17.4, allowing unauthenticated attackers to run arbitrary PHP on the server via unsafe deserialization. The is_safe_widget_instance guard is bypassed because PHP fires magic methods during pre-parse and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() executes; the malicious block markup reaches the sink through the V2 single-event template running do_blocks() over buffered comment HTML. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis, though the vulnerability is well-documented with pinpointed source-line references.

PHP WordPress RCE Deserialization The Events Calendar
CVE-2026-77006 CRITICAL CVSS 9.6
Arbitrary file deletion in the WebTotem Backups WordPress plugin (through version 1.0.1) allows any authenticated low-privilege user, including a subscriber, to delete arbitrary files on the server. The plugin fails on three fronts at once: it does not validate the user-supplied file path, performs no capability check on the requester, and discards the outcome of its own CSRF nonce check. Deleting critical files such as wp-config.php can trigger a full site takeover. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw was reported by WPScan.

WordPress CSRF
CVE-2026-77005 CRITICAL CVSS 9.6
Arbitrary file deletion in the CODE MONKEYS PROPOSALS WordPress plugin (all versions through 1.0.1) allows any authenticated user - including a low-privileged subscriber - to delete arbitrary files on the server, because the plugin neither validates the user-supplied file path nor checks the caller's capability. Deleting critical files such as wp-config.php can force WordPress into a reinstallation state, enabling full site takeover. Reported by WPScan; publicly available exploit code exists via the WPScan advisory, though EPSS remains low at 0.15% (4th percentile) and it is not listed in CISA KEV.

WordPress RCE
CVE-2026-75800 CRITICAL CVSS 9.8
Authentication bypass in the Frontegg SAML SSO WordPress plugin through version 1.0.1 lets unauthenticated remote attackers log in as any user, including administrators, because the plugin establishes a session from a SAML authentication response without verifying its cryptographic signature or issuer. Attackers can also create arbitrary accounts, giving them a persistent foothold. No public exploit identified at time of analysis; EPSS is low (0.19%, 8th percentile) but this reflects lack of observed activity, not difficulty of exploitation.

WordPress Authentication Bypass
CVE-2026-90555 HIGH CVSS 7.1
Uncontrolled memory allocation in vLLM's transcription endpoint before 0.28.0 allows authenticated API clients to crash the entire server process by submitting FLAC audio files with forged, inflated sample rate headers. Because vLLM commonly operates as a shared API server across multiple tenants, a single authenticated attacker can deny service to all concurrent users. VulnCheck reported this with a CVSS 4.0 score of 7.1; no public exploit code or CISA KEV listing has been identified at time of analysis.

Denial Of Service Vllm Vllm Project
CVE-2026-90553 HIGH CVSS 8.5
Remote code execution in vLLM's LlavaOnevision2 processor loader allows an attacker who controls a model repository to execute arbitrary code on systems that load that model, bypassing the trust_remote_code=False safety parameter entirely. All vLLM installations prior to version 0.28.0 are affected when loading LlavaOnevision2-architecture models; the security control that operators rely on to safely evaluate third-party models is silently non-functional for this processor class. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only the ability to publish a model to an accessible registry and social-engineer a user into loading it.

RCE Code Injection Vllm Vllm Project
CVE-2026-90537 HIGH CVSS 8.8
Missing authorization in WWBN AVideo's Scheduler email plugin exposes private subscriber email addresses, live-stream titles, and scheduled job metadata to any unauthenticated network attacker who can supply a valid site-wide daily token. The daily token is obtainable without authentication from publicly accessible Live pages, making the attack effectively unauthenticated for instances with open Live pages. No public exploit code has been identified at time of analysis, but the attack path is mechanically straightforward and the confidentiality impact is high given the exposure of user email addresses.

PHP Avideo Wwbn
CVE-2026-90474 HIGH CVSS 7.6
MCPHub's embedded OAuth 2.0 authorization server before v1.0.32 allows an attacker who intercepts a victim's authorization code to redeem it for valid access tokens without supplying a client secret or PKCE verifier. The root cause is a logic inversion in client authentication: the pre-fix condition checked `if (clientSecret && client.clientSecret)`, meaning that omitting the secret in a token request caused the entire secret-validation block to be skipped, even for confidential clients with a registered secret. Simultaneously, PKCE enforcement was absent for public clients, leaving no proof-of-possession check between code issuance and token exchange. Vendor-released patch v1.0.32 is available; no public exploit or CISA KEV listing has been identified at time of analysis.

Authentication Bypass
CVE-2026-87888 HIGH CVSS 8.0
Stored cross-site scripting in the YayPricing WordPress plugin before 3.5.7 lets any authenticated subscriber-role user inject arbitrary JavaScript into the plugin's pricing rules via an unprotected REST API endpoint that lacks authorization checks. The payload persists server-side and executes in the browser of any WordPress administrator who subsequently opens the YayPricing settings page, enabling session hijacking or full administrative account takeover. No public exploit code has been identified at time of analysis, and the vendor-released fix is available in version 3.5.7.

WordPress XSS
CVE-2026-87842 HIGH CVSS 7.5
Unauthenticated credential token disclosure in the Zonify WordPress plugin before 1.0.5 exposes the site's stored service account login token to any remote attacker without authentication. The plugin fails to perform any WordPress capability check or authentication verification before returning the stored token, allowing retrieval by any network-reachable actor. An attacker who obtains the token can then authenticate to the site owner's linked third-party service account, effectively achieving full account takeover of the integrated service. No public exploit code has been identified at time of analysis, and EPSS stands at 0.18%, but the zero-barrier exploitation profile - unauthenticated, low complexity, network-accessible - makes the vulnerability trivial to abuse once discovered.

WordPress Information Disclosure
CVE-2026-87759 HIGH CVSS 8.8
Privilege escalation in the Add User Autocomplete WordPress plugin before 1.2 allows any authenticated user - including subscribers - to self-assign the administrator role on a WordPress multisite installation by submitting a crafted site-membership invitation request with an attacker-controlled role parameter. The plugin performs no capability check (no `current_user_can()`) and no nonce validation before accepting and creating the invitation, making the attack trivial for any account holder. No public exploit or CISA KEV listing is identified at time of analysis; EPSS sits at 0.13% (3rd percentile), but the low barrier (subscriber-level auth) makes any multisite deployment with this plugin a meaningful lateral escalation risk.

WordPress Privilege Escalation
CVE-2026-85200 HIGH CVSS 7.5
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.

PHP WordPress RCE Information Disclosure LFI
CVE-2026-84099 HIGH CVSS 8.1
PHP Object Injection in the wpstorecart WordPress plugin (through 5.0.7) exposes an unauthenticated deserialization endpoint bundled as an add-on, permitting attackers to inject arbitrary PHP objects without class restrictions. Exploitation to full system compromise (RCE) is contingent on the presence of a suitable POP gadget chain elsewhere in the WordPress environment - a condition that is common on complex WordPress installations running multiple plugins. No public exploit code has been identified at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting low current exploitation activity.

PHP WordPress Deserialization

Track CVEs for your stack Sign up free →

Today's Vulnerabilities Vulnerabilities