Advisories
Vulnerability Advisories
Every CVE we have analysed: what it is, how bad it really is, who is affected and what to do about it. Written by the team that found and disclosed three of them.
| Published | Product | Severity | Class | CVSS | CVE | Analysis |
|---|---|---|---|---|---|---|
| Oct 29, 2026 | Linux Kernel | Critical | Use-after-free race condition in the IPv4 TCP stack, chained to remote root via MPTCP | 9.8 | CVE-2026-98432 | Read |
| Oct 23, 2026 | Google Brotli (ecosystem-wide) | Critical | Out-of-bounds write in the Brotli decoder, cross-ecosystem unauthenticated RCE wherever attacker-controlled Brotli data is decompressed | 9.2 | CVE-2026-111497 | Read |
| Oct 22, 2026 | Node.js | Critical | Out-of-bounds write in the bundled Brotli decoder, to unauthenticated RCE or process crash | 9.2 | CVE-2026-111497 | Read |
| Oct 21, 2026 | PHP core | Critical | Use-after-free in core PHP request handling — OOM corruption and stale global state — to pre-auth RCE and memory disclosure | 9.2 | CVE-2026-109618 (+CVE-2026-109619) | Read |
| Sep 23, 2026 | Next.js | Critical | SVG injection via unescaped XML serialization, to RCE | 9.5 | CVE-2026-94545 | Read |
| Sep 22, 2026 | WordPress core | High | Selector injection: forced theme install, chained to RCE | 7.1 | Pending | Read |
| Sep 22, 2026 | WordPress core | Critical | Path traversal: unauthenticated LFI, RCE on some servers | 9.2 | CVE-2026-87902 | Read |
| Sep 15, 2026 | The Events Calendar | Critical | Code injection to RCE | 9.8 | CVE-2026-78159 | Read |
| Sep 15, 2026 | Amelia Premium | Critical | Unauthenticated privilege escalation to admin | 9.8 | CVE-2026-9055 | Read |
| Aug 22, 2026 | Forminator Forms | Critical | Arbitrary file upload to RCE, unauthenticated | 9.8 | CVE-2026-15748 | Read |
| Aug 22, 2026 | Forminator Forms | Critical | PHP object injection to RCE | 9.8 | CVE-2026-66583 | Read |
| Aug 22, 2026 | W3 Total Cache | Critical | Path traversal to arbitrary file write | 10.0 | CVE-2026-18051 | Read |
| Aug 22, 2026 | WooCommerce Subscriptions | Critical | PHP object injection to RCE, unauthenticated | 9.8 | CVE-2026-18391 | Read |
| Aug 22, 2026 | WPvivid Backup | Critical | Path traversal | 9.1 | CVE-2026-19725 | Read |
| Jul 28, 2026 | vBulletin | Critical | Eval injection, pre-auth RCE | 9.8 | CVE-2026-61511 | Read |
| Jul 18, 2026 | WordPress core | Critical | REST batch route confusion, SQL injection, pre-auth RCE | 9.8 | CVE-2026-63030 (+CVE-2026-60137) | Read |
| Aug 14, 2024 | Tutor LMS | High | SQL injection | 8.8 | CVE-2024-1751 | Read |
| Mar 12, 2024 | Amelia | Medium | Reflected XSS | 6.1 | CVE-2024-1484 | Read |
| Feb 27, 2024 | WP Booking Calendar | Critical | SQL injection | 9.8 | CVE-2024-1207 | Read |
Exposure Check
Running one of the affected versions?
We will verify what you actually run, confirm whether the flaw was exploited before you patched, and test the fix. One visit from our team tells you where you stand.
Request a Check