rapid7

CVE-2026-12757: icegram: The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin…

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up ...
rapid7

CVE-2026-86428: thephpleague commonmark: commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when…

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with ...
rapid7

CVE-2026-86265: itsourcecode Sales and Inventory System: A vulnerability has been found in itsourcecode Sales and Inventory System 1.0

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/us_transac.php. Such manipulation of the ...
rapid7

CVE-2026-78043: OpenVPN: The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the…

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
rapid7

CVE-2026-86302: code-projects Hospital Information System: A vulnerability was found in code-projects Hospital Information System 1.0

A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the component SQL Database Backup ...
rapid7

CVE-2026-86269: itsourcecode Sales and Inventory System: A flaw has been found in itsourcecode Sales and Inventory System 1.0

A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/emp_edit1.php. This manipulation of the argument ID causes sql ...
rapid7

CVE-2026-86119: Server-Side Request Forgery (SSRF)

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE ...
rapid7

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy ...
rapid7

CVE-2026-53769: Missing Authorization

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and ...
rapid7

CVE-2026-86317: ggml-org llama.cpp: A vulnerability was detected in ggml-org llama.cpp up to 0.4.0

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of ...
rapid7

CVE-2026-18796: Nordic Semiconductor ASA nRF5340: Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for…

Any application that uses external QSPI flash for encrypted XIP on nRF5340 and relies on that encryption for confidentiality and/or integrity of the externally stored code. No specific nRF Connect SDK ...
rapid7

CVE-2026-18078: Integer Overflow or Wraparound

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow. CVSS 3.1 Base Score: 6.5 CVSS 3.1 ...