CVE Alert: CVE-2026-85215 - GG Soft Software Services Inc. - Paperwork - https://www.redpacketsecurity.com/cve-alert-cve-2026-85215-gg-soft-software-services-inc-paperwork/
RedPacket Security
CVE Alert: CVE-2026-85215 - GG Soft Software Services Inc. - Paperwork - RedPacket Security
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwork allows SQL
CVE Alert: CVE-2026-104637 - onetwothreeneth - HospitalManagementSystem - https://www.redpacketsecurity.com/cve-alert-cve-2026-104637-onetwothreeneth-hospitalmanagementsystem/
RedPacket Security
CVE Alert: CVE-2026-104637 - onetwothreeneth - HospitalManagementSystem - RedPacket Security
A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the
CVE Alert: CVE-2026-104988 - Red Hat - Red Hat Certificate System 10 - https://www.redpacketsecurity.com/cve-alert-cve-2026-104988-red-hat-red-hat-certificate-system-10/
RedPacket Security
CVE Alert: CVE-2026-104988 - Red Hat - Red Hat Certificate System 10 - RedPacket Security
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via
CVE Alert: CVE-2026-93875 - Crocoblock - JetAppointment - https://www.redpacketsecurity.com/cve-alert-cve-2026-93875-crocoblock-jetappointment/
RedPacket Security
CVE Alert: CVE-2026-93875 - Crocoblock - JetAppointment - RedPacket Security
The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including,
CVE Alert: CVE-2026-104478 - getformwork - formwork - https://www.redpacketsecurity.com/cve-alert-cve-2026-104478-getformwork-formwork/
RedPacket Security
CVE Alert: CVE-2026-104478 - getformwork - formwork - RedPacket Security
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files.
CVE Alert: CVE-2026-82039 - UTMStack - UTMStack - https://www.redpacketsecurity.com/cve-alert-cve-2026-82039-utmstack-utmstack/
RedPacket Security
CVE Alert: CVE-2026-82039 - UTMStack - UTMStack - RedPacket Security
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject
CVE Alert: CVE-2026-104991 - Alanaktion - phproject - https://www.redpacketsecurity.com/cve-alert-cve-2026-104991-alanaktion-phproject/
RedPacket Security
CVE Alert: CVE-2026-104991 - Alanaktion - phproject - RedPacket Security
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments,
CVE Alert: CVE-2026-82044 - UTMStack - UTMStack - https://www.redpacketsecurity.com/cve-alert-cve-2026-82044-utmstack-utmstack/
RedPacket Security
CVE Alert: CVE-2026-82044 - UTMStack - UTMStack - RedPacket Security
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal
CVE Alert: CVE-2026-104433 - kvcache-ai - Mooncake - https://www.redpacketsecurity.com/cve-alert-cve-2026-104433-kvcache-ai-mooncake/
RedPacket Security
CVE Alert: CVE-2026-104433 - kvcache-ai - Mooncake - RedPacket Security
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated
CVE Alert: CVE-2026-96270 - ultimatemember - Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin - https://www.redpacketsecurity.com/cve-alert-cve-2026-96270-ultimatemember-ultimate-member-user-profile-registration-login-member-directory-content-restriction-membership-plugin/
RedPacket Security
CVE Alert: CVE-2026-96270 - ultimatemember - Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction…
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to
CVE Alert: CVE-2026-93428 - ultimatemember - Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin - https://www.redpacketsecurity.com/cve-alert-cve-2026-93428-ultimatemember-ultimate-member-user-profile-registration-login-member-directory-content-restriction-membership-plugin/
RedPacket Security
CVE Alert: CVE-2026-93428 - ultimatemember - Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction…
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to
CVE Alert: CVE-2026-92977 - devowl - Real Cookie Banner: GDPR & ePrivacy Cookie Consent - https://www.redpacketsecurity.com/cve-alert-cve-2026-92977-devowl-real-cookie-banner-gdpr-eprivacy-cookie-consent/
RedPacket Security
CVE Alert: CVE-2026-92977 - devowl - Real Cookie Banner: GDPR & ePrivacy Cookie Consent - RedPacket Security
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up
CVE Alert: CVE-2026-92536 - properfraction - Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress - https://www.redpacketsecurity.com/cve-alert-cve-2026-92536-properfraction-paid-membership-plugin-ecommerce-user-registration-form-login-form-user-profile-restrict-content-profilepress/
RedPacket Security
CVE Alert: CVE-2026-92536 - properfraction - Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile…
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is
[WALLSTREET] - Ransomware Victim: World Cup 2034 - https://www.redpacketsecurity.com/wallstreet-ransomware-victim-world-cup-2034/
RedPacket Security
[WALLSTREET] - Ransomware Victim: World Cup 2034 - RedPacket Security
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating
[WALLSTREET] - Ransomware Victim: St[.] Francis Healthcare Systems of Hawaii - https://www.redpacketsecurity.com/wallstreet-ransomware-victim-st-francis-healthcare-systems-of-hawaii/
RedPacket Security
[WALLSTREET] - Ransomware Victim: St[.] Francis Healthcare Systems of Hawaii - RedPacket Security
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating
CVE Alert: CVE-2026-97644 - trainingbusinesspros - Groundhogg — CRM, Newsletters, and Marketing Automation - https://www.redpacketsecurity.com/cve-alert-cve-2026-97644-trainingbusinesspros-groundhogg-crm-newsletters-and-marketing-automation/
RedPacket Security
CVE Alert: CVE-2026-97644 - trainingbusinesspros - Groundhogg — CRM, Newsletters, and Marketing Automation - RedPacket Security
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all
CVE Alert: CVE-2026-103913 - paoltaia - GeoDirectory – WP Business Directory Plugin and Classified Listings Directory - https://www.redpacketsecurity.com/cve-alert-cve-2026-103913-paoltaia-geodirectory-wp-business-directory-plugin-and-classified-listings-directory/
RedPacket Security
CVE Alert: CVE-2026-103913 - paoltaia - GeoDirectory – WP Business Directory Plugin and Classified Listings Directory - RedPacket…
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and
CVE Alert: CVE-2026-87091 - uscnanbu - Welcart e-Commerce - https://www.redpacketsecurity.com/cve-alert-cve-2026-87091-uscnanbu-welcart-e-commerce/
RedPacket Security
CVE Alert: CVE-2026-87091 - uscnanbu - Welcart e-Commerce - RedPacket Security
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and
CVE Alert: CVE-2026-101928 - magicplugins - Magic Tooltips For Contact Form 7 - https://www.redpacketsecurity.com/cve-alert-cve-2026-101928-magicplugins-magic-tooltips-for-contact-form-7/
RedPacket Security
CVE Alert: CVE-2026-101928 - magicplugins - Magic Tooltips For Contact Form 7 - RedPacket Security
The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and
CVE Alert: CVE-2026-101923 - villatheme - Photo Reviews for WooCommerce - https://www.redpacketsecurity.com/cve-alert-cve-2026-101923-villatheme-photo-reviews-for-woocommerce/
RedPacket Security
CVE Alert: CVE-2026-101923 - villatheme - Photo Reviews for WooCommerce - RedPacket Security
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to
CVE Alert: CVE-2026-93430 - gdragon - GD Rating System - https://www.redpacketsecurity.com/cve-alert-cve-2026-93430-gdragon-gd-rating-system/
RedPacket Security
CVE Alert: CVE-2026-93430 - gdragon - GD Rating System - RedPacket Security
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX in all