Blog
Security news and analysis
Critical vulnerabilities, actively exploited flaws, WordPress plugin issues, breaches and malware campaigns, explained for people who run websites: what happened, who is affected and what to do now. Every article lists its sources.
14 articles · page 1 of 2
Signal K Path Traversal: JWT Secret Leak and RCE Fix
A critical path traversal in the Signal K resources API can expose the JWT signing secret, allow admin token forgery and lead to command execution. Update signalk-server to 2.34.0.
Laravel CVE-2026-114509: TokenGuard Auth Bypass Fix
A critical flaw in Laravel's TokenGuard (CVE-2026-114509) can let an unauthenticated attacker sign in as another user on some MySQL/MariaDB setups. Upgrade to laravel/framework 12.68.0 or 13.29.0.
Pillow CVE-2026-112398: FPX Heap Overflow Leads to RCE
A critical heap buffer overflow in Pillow's FlashPix (FPX) JPEG decoder can lead to code execution when an application opens a crafted file. Versions up to 12.3.0 are affected; 13.0.0 is the patched release.
CVE-2026-109220: PDF Invoice for WooCommerce RCE (9.8)
A critical flaw in the PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin allows unauthenticated PHP object injection through a checkout note field. All versions up to 7.1.1 are listed as affected.
CVE-2026-89270: Popup Builder Plugin Auth Bypass (9.1)
A critical missing-authorization flaw (CVSS 9.1) in the Popup Builder WordPress plugin lets unauthenticated visitors trash all published popups with one GET request. Versions up to 4.4.5 are listed as affected.
CVE-2026-116512: Project Manager Plugin RCE (9.8)
A critical flaw, CVE-2026-116512, lets unauthenticated attackers run code on sites using the Project Manager WordPress plugin up to version 4.1.1. A fixed version is not confirmed yet.
CVE-2026-119096: Uncanny Toolkit for LearnDash Auth Bypass
A critical authentication bypass in the Uncanny Toolkit for LearnDash plugin, up to and including version 3.8.2, can defeat account-approval and account-suspension controls. Here is what is known and what to do.
CVE-2026-103882: Acadlix LMS Plugin File Deletion Flaw
A critical arbitrary file deletion flaw, CVE-2026-103882, affects the Acadlix LMS WordPress plugin up to and including 1.1.9. Here is what is known, what is not, and how to reduce your risk.
CVE-2026-118235: SimpleForm WordPress Plugin File Upload
A critical arbitrary file upload flaw, CVE-2026-118235, affects the SimpleForm WordPress plugin up to and including 3.10.2. Here is what is known, who is exposed and what to do.
Actively exploitedPHP CVE-2026-109619: Exploited RCE Flaw and How to Patch
A critical PHP flaw that can lead to unauthenticated remote code execution has been added to CISA's Known Exploited Vulnerabilities catalog. Here is who is exposed and how to patch.
Actively exploitedCVE-2026-48356: Adobe Commerce and Magento Exploited
CISA added CVE-2026-48356, a critical unrestricted file upload flaw in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog. Here is what is confirmed, what is not, and how to respond.
Actively exploited