Prefer Telegram for triage? Same cards, same canonical links.
Join us!
https://t.me/fc_vulns
#fcvulns #CVE
Join us!
https://t.me/fc_vulns
#fcvulns #CVE
November 4, 2026 at 8:00 PM
Prefer Telegram for triage? Same cards, same canonical links.
Join us!
https://t.me/fc_vulns
#fcvulns #CVE
Join us!
https://t.me/fc_vulns
#fcvulns #CVE
Same fc-vulns CVE signal, in a channel you can skim fast.
Join us on Telegram!
t.me/fc_vulns
#fcvulns #CVE
Join us on Telegram!
t.me/fc_vulns
#fcvulns #CVE
fc-vulns - vulnerability intelligence index
CVE intelligence with CVSS, CWE, EPSS, KEV and other signals — built for better analysis.
t.me
November 3, 2026 at 2:34 PM
Same fc-vulns CVE signal, in a channel you can skim fast.
Join us on Telegram!
t.me/fc_vulns
#fcvulns #CVE
Join us on Telegram!
t.me/fc_vulns
#fcvulns #CVE
Same fc-vulns CVE signal, in a channel you can skim fast.
Join us on Telegram!
t.me/fc_vulns
#fcvulns #CVE
Join us on Telegram!
t.me/fc_vulns
#fcvulns #CVE
fc-vulns - vulnerability intelligence index
CVE intelligence with CVSS, CWE, EPSS, KEV and other signals — built for better analysis.
t.me
November 3, 2026 at 11:28 AM
Same fc-vulns CVE signal, in a channel you can skim fast.
Join us on Telegram!
t.me/fc_vulns
#fcvulns #CVE
Join us on Telegram!
t.me/fc_vulns
#fcvulns #CVE
Watch this new critical WP plugin. CVE-2026-119481 — CVSS 9.8.
Crocoblock JetFormBuilder ≤3.6.7.1: privilege escalation via Incorrect Privilege Assignment.
https://www.fc-vulns.com/cve/CVE-2026-119481/
#fcvulns #Wordpress
Crocoblock JetFormBuilder ≤3.6.7.1: privilege escalation via Incorrect Privilege Assignment.
https://www.fc-vulns.com/cve/CVE-2026-119481/
#fcvulns #Wordpress
CVE-2026-119481 · Patchstack · CVSS 9.8 · fc-vulns
Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder…
www.fc-vulns.com
November 4, 2026 at 6:45 PM
Watch this new critical WP plugin. CVE-2026-119481 — CVSS 9.8.
Crocoblock JetFormBuilder ≤3.6.7.1: privilege escalation via Incorrect Privilege Assignment.
https://www.fc-vulns.com/cve/CVE-2026-119481/
#fcvulns #Wordpress
Crocoblock JetFormBuilder ≤3.6.7.1: privilege escalation via Incorrect Privilege Assignment.
https://www.fc-vulns.com/cve/CVE-2026-119481/
#fcvulns #Wordpress
Short CVE notes belong in more than one place. Telegram channel for the same fc-vulns signal:
https://t.me/fc_vulns
#fcvulns #CVE
https://t.me/fc_vulns
#fcvulns #CVE
fc-vulns - vulnerability intelligence index
CVE intelligence with CVSS, CWE, EPSS, KEV and other signals — built for better analysis.
t.me
November 2, 2026 at 11:00 AM
Short CVE notes belong in more than one place. Telegram channel for the same fc-vulns signal:
https://t.me/fc_vulns
#fcvulns #CVE
https://t.me/fc_vulns
#fcvulns #CVE
Watch this critical one.
CVE-2026-116512 published 2026-10-31 — CVSS 9.8.
WordPress Project Manager plugin ≤4.1.1: unauth RCE via unsanitized 'id' parameter invoked as a dynamic PHP function.
https://www.fc-vulns.com/cve/CVE-2026-116512/
#fcvulns #Wordpress
CVE-2026-116512 published 2026-10-31 — CVSS 9.8.
WordPress Project Manager plugin ≤4.1.1: unauth RCE via unsanitized 'id' parameter invoked as a dynamic PHP function.
https://www.fc-vulns.com/cve/CVE-2026-116512/
#fcvulns #Wordpress
CVE-2026-116512 · Wordfence · CVSS 9.8 · fc-vulns
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code…
www.fc-vulns.com
October 31, 2026 at 6:30 PM
Watch this critical one.
CVE-2026-116512 published 2026-10-31 — CVSS 9.8.
WordPress Project Manager plugin ≤4.1.1: unauth RCE via unsanitized 'id' parameter invoked as a dynamic PHP function.
https://www.fc-vulns.com/cve/CVE-2026-116512/
#fcvulns #Wordpress
CVE-2026-116512 published 2026-10-31 — CVSS 9.8.
WordPress Project Manager plugin ≤4.1.1: unauth RCE via unsanitized 'id' parameter invoked as a dynamic PHP function.
https://www.fc-vulns.com/cve/CVE-2026-116512/
#fcvulns #Wordpress
Heads up — new critical CVSS. CVE-2026-114549 — CVSS 9.8.
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability.
https://www.fc-vulns.com/cve/CVE-2026-114549/
#fcvulns #Trendmicro
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability.
https://www.fc-vulns.com/cve/CVE-2026-114549/
#fcvulns #Trendmicro
CVE-2026-114549 · Trend Micro ZDI · CVSS 9.8 · fc-vulns
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
www.fc-vulns.com
November 4, 2026 at 7:45 AM
Heads up — new critical CVSS. CVE-2026-114549 — CVSS 9.8.
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability.
https://www.fc-vulns.com/cve/CVE-2026-114549/
#fcvulns #Trendmicro
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability.
https://www.fc-vulns.com/cve/CVE-2026-114549/
#fcvulns #Trendmicro
Watch this new critical CVE. CVE-2026-97693 — CVSS 9.9.
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform.
https://www.fc-vulns.com/cve/CVE-2026-97693/
#fcvulns #CWE77
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform.
https://www.fc-vulns.com/cve/CVE-2026-97693/
#fcvulns #CWE77
CVE-2026-97693 · GitHub_M · CVSS 9.9 · fc-vulns
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is…
www.fc-vulns.com
November 4, 2026 at 10:15 PM
Watch this new critical CVE. CVE-2026-97693 — CVSS 9.9.
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform.
https://www.fc-vulns.com/cve/CVE-2026-97693/
#fcvulns #CWE77
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform.
https://www.fc-vulns.com/cve/CVE-2026-97693/
#fcvulns #CWE77
Don’t miss this critical one.
CVE-2026-61991 published 2026-10-29 — CVSS 10.0 v3.1.
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
https://www.fc-vulns.com/cve/CVE-2026-61991/
#fcvulns #Patchstack
CVE-2026-61991 published 2026-10-29 — CVSS 10.0 v3.1.
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
https://www.fc-vulns.com/cve/CVE-2026-61991/
#fcvulns #Patchstack
CVE-2026-61991 · Patchstack · CVSS 10 · fc-vulns
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. CVSS 10.0 (v3.1) · EPSS 0.00
www.fc-vulns.com
October 29, 2026 at 8:00 PM
Don’t miss this critical one.
CVE-2026-61991 published 2026-10-29 — CVSS 10.0 v3.1.
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
https://www.fc-vulns.com/cve/CVE-2026-61991/
#fcvulns #Patchstack
CVE-2026-61991 published 2026-10-29 — CVSS 10.0 v3.1.
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
https://www.fc-vulns.com/cve/CVE-2026-61991/
#fcvulns #Patchstack
Watch this new critical. CVE-2026-28336 — CVSS 9.9.
SolarWinds Dameware command injection can lead to compromise of the remotely controlled host. Auth required.
https://www.fc-vulns.com/cve/CVE-2026-28336/
#fcvulns #SolarWinds
SolarWinds Dameware command injection can lead to compromise of the remotely controlled host. Auth required.
https://www.fc-vulns.com/cve/CVE-2026-28336/
#fcvulns #SolarWinds
CVE-2026-28336 · SolarWinds · CVSS 9.9 · fc-vulns
SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host…
www.fc-vulns.com
November 3, 2026 at 6:30 PM
Watch this new critical. CVE-2026-28336 — CVSS 9.9.
SolarWinds Dameware command injection can lead to compromise of the remotely controlled host. Auth required.
https://www.fc-vulns.com/cve/CVE-2026-28336/
#fcvulns #SolarWinds
SolarWinds Dameware command injection can lead to compromise of the remotely controlled host. Auth required.
https://www.fc-vulns.com/cve/CVE-2026-28336/
#fcvulns #SolarWinds
Heads up — sharp EPSS move today.
CVE-2026-102764: EPSS +59.0 points (18.9 → 78.0, 0–100 scale).
The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
https://www.fc-vulns.com/cve/CVE-2026-102764/
#fcvulns #KEV
CVE-2026-102764: EPSS +59.0 points (18.9 → 78.0, 0–100 scale).
The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
https://www.fc-vulns.com/cve/CVE-2026-102764/
#fcvulns #KEV
CVE-2026-102764 · BeyondTrust Inc. · CVSS 9.3 · KEV · fc-vulns
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the…
www.fc-vulns.com
November 4, 2026 at 3:30 PM
Heads up — sharp EPSS move today.
CVE-2026-102764: EPSS +59.0 points (18.9 → 78.0, 0–100 scale).
The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
https://www.fc-vulns.com/cve/CVE-2026-102764/
#fcvulns #KEV
CVE-2026-102764: EPSS +59.0 points (18.9 → 78.0, 0–100 scale).
The vulnerability exists within internal components of BeyondTrust’s Remote Support product.
https://www.fc-vulns.com/cve/CVE-2026-102764/
#fcvulns #KEV
CVE-2026-96652: EPSS +10.1 points (1.8 → 11.9, 0–100 scale).
Heads up — sharp EPSS move today.
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.
https://www.fc-vulns.com/cve/CVE-2026-96652/
#fcvulns #KEV
Heads up — sharp EPSS move today.
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.
https://www.fc-vulns.com/cve/CVE-2026-96652/
#fcvulns #KEV
CVE-2026-96652 · CISA · CVSS 5.3 · KEV · fc-vulns
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the…
www.fc-vulns.com
November 3, 2026 at 3:30 PM
CVE-2026-96652: EPSS +10.1 points (1.8 → 11.9, 0–100 scale).
Heads up — sharp EPSS move today.
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.
https://www.fc-vulns.com/cve/CVE-2026-96652/
#fcvulns #KEV
Heads up — sharp EPSS move today.
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'.
https://www.fc-vulns.com/cve/CVE-2026-96652/
#fcvulns #KEV
Attention: new KEV. CVE-2026-119977 added to CISA KEV.
WordPress Core RCE in 4.7-7.1.3: predictable staging paths during upgrades let unauth attackers run code in the upgrade window.
https://www.fc-vulns.com/cve/CVE-2026-119977/
#fcvulns #Wordpress
WordPress Core RCE in 4.7-7.1.3: predictable staging paths during upgrades let unauth attackers run code in the upgrade window.
https://www.fc-vulns.com/cve/CVE-2026-119977/
#fcvulns #Wordpress
CVE-2026-119977 · Wordfence · CVSS 8.1 · KEV · fc-vulns
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during…
www.fc-vulns.com
November 4, 2026 at 12:00 AM
Attention: new KEV. CVE-2026-119977 added to CISA KEV.
WordPress Core RCE in 4.7-7.1.3: predictable staging paths during upgrades let unauth attackers run code in the upgrade window.
https://www.fc-vulns.com/cve/CVE-2026-119977/
#fcvulns #Wordpress
WordPress Core RCE in 4.7-7.1.3: predictable staging paths during upgrades let unauth attackers run code in the upgrade window.
https://www.fc-vulns.com/cve/CVE-2026-119977/
#fcvulns #Wordpress
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function.
https://www.fc-vulns.com/cve/CVE-2026-120534/
#fcvulns #Wordpress
https://www.fc-vulns.com/cve/CVE-2026-120534/
#fcvulns #Wordpress
CVE-2026-120534 · Wordfence · CVSS 9.8 · fc-vulns
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via…
www.fc-vulns.com
November 3, 2026 at 9:30 AM
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function.
https://www.fc-vulns.com/cve/CVE-2026-120534/
#fcvulns #Wordpress
https://www.fc-vulns.com/cve/CVE-2026-120534/
#fcvulns #Wordpress
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive.
https://www.fc-vulns.com/cve/CVE-2026-116606/
#fcvulns #CWE288
https://www.fc-vulns.com/cve/CVE-2026-116606/
#fcvulns #CWE288
CVE-2026-116606 · Mandiant Inc. · CVSS 9.3 · fc-vulns
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a…
www.fc-vulns.com
November 2, 2026 at 5:00 PM
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive.
https://www.fc-vulns.com/cve/CVE-2026-116606/
#fcvulns #CWE288
https://www.fc-vulns.com/cve/CVE-2026-116606/
#fcvulns #CWE288
CVE-2026-103039 published 2026-10-30 — CVSS 9.8 v3.1.
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List.
https://www.fc-vulns.com/cve/CVE-2026-103039/
#fcvulns #Wordfence
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List.
https://www.fc-vulns.com/cve/CVE-2026-103039/
#fcvulns #Wordfence
CVE-2026-103039 · Wordfence · CVSS 9.8 · fc-vulns
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose…
www.fc-vulns.com
October 30, 2026 at 9:00 AM
CVE-2026-103039 published 2026-10-30 — CVSS 9.8 v3.1.
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List.
https://www.fc-vulns.com/cve/CVE-2026-103039/
#fcvulns #Wordfence
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List.
https://www.fc-vulns.com/cve/CVE-2026-103039/
#fcvulns #Wordfence
Critical CVSS 9.8 — don’t miss this WP plugin.
CVE-2026-102435 published 2026-11-02 — CVSS 9.8 v3.1.
Ultra Addons for CF7 ≤3.5.54: unauth arbitrary file deletion via _getObjAttr when PDF Generator is on; can lead to RCE. CWE-502.
https://www.fc-vulns.com/cve/CVE-2026-102435/
#fcvulns #Wordpress
CVE-2026-102435 published 2026-11-02 — CVSS 9.8 v3.1.
Ultra Addons for CF7 ≤3.5.54: unauth arbitrary file deletion via _getObjAttr when PDF Generator is on; can lead to RCE. CWE-502.
https://www.fc-vulns.com/cve/CVE-2026-102435/
#fcvulns #Wordpress
CVE-2026-102435 · Wordfence · CVSS 9.8 · fc-vulns
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the…
www.fc-vulns.com
November 3, 2026 at 12:00 AM
Critical CVSS 9.8 — don’t miss this WP plugin.
CVE-2026-102435 published 2026-11-02 — CVSS 9.8 v3.1.
Ultra Addons for CF7 ≤3.5.54: unauth arbitrary file deletion via _getObjAttr when PDF Generator is on; can lead to RCE. CWE-502.
https://www.fc-vulns.com/cve/CVE-2026-102435/
#fcvulns #Wordpress
CVE-2026-102435 published 2026-11-02 — CVSS 9.8 v3.1.
Ultra Addons for CF7 ≤3.5.54: unauth arbitrary file deletion via _getObjAttr when PDF Generator is on; can lead to RCE. CWE-502.
https://www.fc-vulns.com/cve/CVE-2026-102435/
#fcvulns #Wordpress
Watch this critical CVE.
CVE-2025-11969 published 2026-11-02 — CVSS 9.4.
WSO2 API Manager System REST APIs lack proper access control, so lower-privilege users can run admin actions (CWE-285).
https://www.fc-vulns.com/cve/CVE-2025-11969/
#fcvulns #WSO2
CVE-2025-11969 published 2026-11-02 — CVSS 9.4.
WSO2 API Manager System REST APIs lack proper access control, so lower-privilege users can run admin actions (CWE-285).
https://www.fc-vulns.com/cve/CVE-2025-11969/
#fcvulns #WSO2
CVE-2025-11969 · WSO2 LLC · CVSS 9.4 · fc-vulns
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that…
www.fc-vulns.com
November 2, 2026 at 7:45 AM
Watch this critical CVE.
CVE-2025-11969 published 2026-11-02 — CVSS 9.4.
WSO2 API Manager System REST APIs lack proper access control, so lower-privilege users can run admin actions (CWE-285).
https://www.fc-vulns.com/cve/CVE-2025-11969/
#fcvulns #WSO2
CVE-2025-11969 published 2026-11-02 — CVSS 9.4.
WSO2 API Manager System REST APIs lack proper access control, so lower-privilege users can run admin actions (CWE-285).
https://www.fc-vulns.com/cve/CVE-2025-11969/
#fcvulns #WSO2
CVE-2026-112816 published 2026-10-30 — CVSS 10.0 v4.0.
Attention on this new critical CVE.
https://www.fc-vulns.com/cve/CVE-2026-112816/
#fcvulns #CWE295
Attention on this new critical CVE.
https://www.fc-vulns.com/cve/CVE-2026-112816/
#fcvulns #CWE295
CVE-2026-112816 · canonical · CVSS 10 · fc-vulns
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an…
www.fc-vulns.com
October 30, 2026 at 6:00 PM
CVE-2026-112816 published 2026-10-30 — CVSS 10.0 v4.0.
Attention on this new critical CVE.
https://www.fc-vulns.com/cve/CVE-2026-112816/
#fcvulns #CWE295
Attention on this new critical CVE.
https://www.fc-vulns.com/cve/CVE-2026-112816/
#fcvulns #CWE295
Watch this EPSS jump: CVE-2021-3128 +14.0 pts (2.2 → 16.2, 0–100).
ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U and related routers can hit an IPv6 routing loop that floods traffic to the ISP (CWE-834).
https://www.fc-vulns.com/cve/CVE-2021-3128/
#fcvulns #EPSS
ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U and related routers can hit an IPv6 routing loop that floods traffic to the ISP (CWE-834).
https://www.fc-vulns.com/cve/CVE-2021-3128/
#fcvulns #EPSS
CVE-2021-3128 · CVSS 7.5 · fc-vulns
In ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U, and other ASUS routers with firmware < 3.0.0.4.386.42095 or < 9.0.0.4.386.41994, when IPv6 is used, a…
www.fc-vulns.com
November 1, 2026 at 3:30 PM
Watch this EPSS jump: CVE-2021-3128 +14.0 pts (2.2 → 16.2, 0–100).
ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U and related routers can hit an IPv6 routing loop that floods traffic to the ISP (CWE-834).
https://www.fc-vulns.com/cve/CVE-2021-3128/
#fcvulns #EPSS
ASUS RT-AX3000, ZenWiFi AX (XT8), RT-AX88U and related routers can hit an IPv6 routing loop that floods traffic to the ISP (CWE-834).
https://www.fc-vulns.com/cve/CVE-2021-3128/
#fcvulns #EPSS
Sharp EPSS move — don’t miss it.
CVE-2023-31719: +18.1 EPSS points (26.0 → 44.1, 0–100).
FUXA ≤ 1.1.12 SQL injection via /api/signin (CWE-89).
https://www.fc-vulns.com/cve/CVE-2023-31719/
#fcvulns #EPSS
CVE-2023-31719: +18.1 EPSS points (26.0 → 44.1, 0–100).
FUXA ≤ 1.1.12 SQL injection via /api/signin (CWE-89).
https://www.fc-vulns.com/cve/CVE-2023-31719/
#fcvulns #EPSS
CVE-2023-31719 · CVSS 9.8 · fc-vulns
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin. CVSS 9.8 (v3.1) · EPSS 44.09
www.fc-vulns.com
October 30, 2026 at 3:30 PM
Sharp EPSS move — don’t miss it.
CVE-2023-31719: +18.1 EPSS points (26.0 → 44.1, 0–100).
FUXA ≤ 1.1.12 SQL injection via /api/signin (CWE-89).
https://www.fc-vulns.com/cve/CVE-2023-31719/
#fcvulns #EPSS
CVE-2023-31719: +18.1 EPSS points (26.0 → 44.1, 0–100).
FUXA ≤ 1.1.12 SQL injection via /api/signin (CWE-89).
https://www.fc-vulns.com/cve/CVE-2023-31719/
#fcvulns #EPSS
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter.
https://www.fc-vulns.com/cve/CVE-2026-109220/
#fcvulns #Wordpress
https://www.fc-vulns.com/cve/CVE-2026-109220/
#fcvulns #Wordpress
CVE-2026-109220 · Wordfence · CVSS 9.8 · fc-vulns
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and…
www.fc-vulns.com
October 31, 2026 at 8:45 AM
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter.
https://www.fc-vulns.com/cve/CVE-2026-109220/
#fcvulns #Wordpress
https://www.fc-vulns.com/cve/CVE-2026-109220/
#fcvulns #Wordpress
CVE-2026-120189 published 2026-11-01 — CVSS 9.3 v4.0.
Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler.
Don’t miss this critical one.
https://www.fc-vulns.com/cve/CVE-2026-120189/
#fcvulns #Vuldb
Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler.
Don’t miss this critical one.
https://www.fc-vulns.com/cve/CVE-2026-120189/
#fcvulns #Vuldb
CVE-2026-120189 · VulDB · CVSS 9.3 · fc-vulns
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the…
www.fc-vulns.com
November 1, 2026 at 9:15 AM
CVE-2026-120189 published 2026-11-01 — CVSS 9.3 v4.0.
Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler.
Don’t miss this critical one.
https://www.fc-vulns.com/cve/CVE-2026-120189/
#fcvulns #Vuldb
Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler.
Don’t miss this critical one.
https://www.fc-vulns.com/cve/CVE-2026-120189/
#fcvulns #Vuldb
CVE-2026-120306 published 2026-11-01 — CVSS 9.9 v3.1.
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker.
Attention on this new critical CVE.
https://www.fc-vulns.com/cve/CVE-2026-120306/
#fcvulns #Jfrog
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker.
Attention on this new critical CVE.
https://www.fc-vulns.com/cve/CVE-2026-120306/
#fcvulns #Jfrog
CVE-2026-120306 · Jfrog · CVSS 9.9 · fc-vulns
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image…
www.fc-vulns.com
November 1, 2026 at 10:30 PM
CVE-2026-120306 published 2026-11-01 — CVSS 9.9 v3.1.
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker.
Attention on this new critical CVE.
https://www.fc-vulns.com/cve/CVE-2026-120306/
#fcvulns #Jfrog
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker.
Attention on this new critical CVE.
https://www.fc-vulns.com/cve/CVE-2026-120306/
#fcvulns #Jfrog
Don't miss this CVSS 10.
CVE-2026-120338 published 2026-11-01 — CVSS 10.0 v3.1.
Prefab UI through 0.20.2 runs caller Python in Pyodide/Deno with open FS/net; untrusted code can R/W server files and persist via .pth (CWE-693).
https://www.fc-vulns.com/cve/CVE-2026-120338/
#fcvulns #Prefab
CVE-2026-120338 published 2026-11-01 — CVSS 10.0 v3.1.
Prefab UI through 0.20.2 runs caller Python in Pyodide/Deno with open FS/net; untrusted code can R/W server files and persist via .pth (CWE-693).
https://www.fc-vulns.com/cve/CVE-2026-120338/
#fcvulns #Prefab
CVE-2026-120338 · JFROG · CVSS 10 · fc-vulns
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is…
www.fc-vulns.com
November 1, 2026 at 4:46 PM
Don't miss this CVSS 10.
CVE-2026-120338 published 2026-11-01 — CVSS 10.0 v3.1.
Prefab UI through 0.20.2 runs caller Python in Pyodide/Deno with open FS/net; untrusted code can R/W server files and persist via .pth (CWE-693).
https://www.fc-vulns.com/cve/CVE-2026-120338/
#fcvulns #Prefab
CVE-2026-120338 published 2026-11-01 — CVSS 10.0 v3.1.
Prefab UI through 0.20.2 runs caller Python in Pyodide/Deno with open FS/net; untrusted code can R/W server files and persist via .pth (CWE-693).
https://www.fc-vulns.com/cve/CVE-2026-120338/
#fcvulns #Prefab