CVE Notify
@cveNotify
19.1K subscribers
4 photos
184K links
Alert on the latest CVEs

Partner channel: @malwr
Download Telegram
About
Blog
Apps
Platform
Join
CVE Notify
19.1K subscribers
CVE Notify
🚨 CVE-2026-54188
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress JetEngine Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
9 views
CVE Notify
🚨 CVE-2026-54189
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress JetEngine Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
8 views
CVE Notify
🚨 CVE-2026-54195
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress JetFormBuilder Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
9 views
CVE Notify
🚨 CVE-2026-54804
Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.

🎖@cveNotify
Patchstack
Broken Authentication in WordPress Melhor Envio Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
7 views
CVE Notify
🚨 CVE-2026-54806
Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

🎖@cveNotify
Patchstack
PHP Object Injection in WordPress WP Activity Log Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
9 views
CVE Notify
🚨 CVE-2026-9690
Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.

🎖@cveNotify
Patchstack
Arbitrary File Download in WordPress WP Media folder Addon Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
8 views
CVE Notify
🚨 CVE-2025-59554
Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions.

🎖@cveNotify
Patchstack
SQL Injection in WordPress Advanced Ads – Tracking Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
9 views
CVE Notify
🚨 CVE-2025-60230
Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection.

This issue affects The Barber Shop: from n/a through 1.9.

🎖@cveNotify
Patchstack
PHP Object Injection in WordPress The Barber Shop Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
11 views
CVE Notify
🚨 CVE-2025-69106
Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.

🎖@cveNotify
Patchstack
Local File Inclusion in WordPress Imba Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
12 views
CVE Notify
🚨 CVE-2025-69115
Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.

🎖@cveNotify
Patchstack
Local File Inclusion in WordPress LuxMed | Medicine & Healthcare Doctor WordPress Theme Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
11 views
CVE Notify
🚨 CVE-2025-69127
Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Plumbing Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
9 views
CVE Notify
🚨 CVE-2025-69130
Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions.

🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Entrepreneur - Booking for Small Businesses WordPress Theme Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
9 views
CVE Notify
🚨 CVE-2025-69158
Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

🎖@cveNotify
Patchstack
Local File Inclusion in WordPress Granola Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
11 views
CVE Notify
🚨 CVE-2025-69166
Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

🎖@cveNotify
Patchstack
Local File Inclusion in WordPress Gunslinger Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
11 views
CVE Notify
🚨 CVE-2025-69189
Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects JobBank: from n/a through 1.2.3.

🎖@cveNotify
Patchstack
Broken Access Control in WordPress JobBank Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
10 views
CVE Notify
🚨 CVE-2026-39445
Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Alukas Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
12 views
CVE Notify
🚨 CVE-2026-39560
Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Hiroshi Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
12 views
CVE Notify
🚨 CVE-2026-39590
Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.

🎖@cveNotify
Patchstack
Local File Inclusion in WordPress Atomlab Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
12 views
CVE Notify
🚨 CVE-2026-40738
Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Eldon Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
13 views
CVE Notify
🚨 CVE-2026-40757
Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Château Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
15 views
CVE Notify
🚨 CVE-2026-49268
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.

This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm
Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.

🎖@cveNotify
12 views