IT Security Blog

Current security alerts, regulatory guidance and practical knowledge for well-founded cyber risk decisions.

Vulnerabilities & Advisories October 23, 2026

Node2Shell: Critical Node.js Security Vulnerability – Find and Fix Affected Software

Node2Shell (CVE-2026-111497): critical vulnerability in Node.js, proof of concept publicly available. Here's how to find affected software and close the gap.

Read Article

Latest Posts

Vulnerabilities October 21, 2026

Apache Traffic Server: multiple critical security vulnerabilities (CVE-2026-111816, CVE-2026-111815, etc.)

Apache Traffic Server has several critical vulnerabilities, including CVE-2026-111816 (CVSS 9.3) and CVE-2026-111815 (CVSS 10). Cache poisoning, HTTP desynchronization, and other attack vectors are possible. Patches available.

Read Article

Vulnerabilities October 21, 2026

PHP2Shell: Exploit for Critical PHP Vulnerability – Find and Close Affected Software

PHP2Shell is being exploited. Here's how to find affected PHP software in your inventory and close CVE-2026-109618 and CVE-2026-109619 with an update.

Read Article

Vulnerabilities October 16, 2026

CVE-2026-103768: Upload Vulnerability in the ELEX HelpDesk Plugin

CVE-2026-103768 affects the ELEX WordPress HelpDesk & Customer Ticketing System up to version 3.3.7. Version 3.3.8 fixes the vulnerability.

Read Article

Vulnerabilities October 14, 2026

CVE-2026-87855: Security Update for JTL-Connector for WooCommerce

CVE-2026-87855 affects JTL-Connector for WooCommerce up to version 2.4.3. Version 2.4.4 or higher fixes the vulnerability.

Read Article

Vulnerabilities October 14, 2026

CVE-2026-70279: XSS Spoofing in Microsoft Exchange Server

CVE-2026-70279 is an XSS spoofing vulnerability in Microsoft Exchange Server.

Read Article

Vulnerabilities October 14, 2026

CVE-2026-93388: Printcart Plugin Allows Code Execution Without Authentication

CVE-2026-93388 affects the Printcart Store Plugin for WooCommerce.

Read Article

Vulnerabilities October 10, 2026

CVE-2026-42718 and CVE-2026-42716: Critical WooCommerce Plugin Vulnerabilities

CVE-2026-42718 affects Booster for WooCommerce up to and including 8.4.0. CVE-2026-42716 affects Payever - WooCommerce Gateway up to and including 4.8.2.

Read Article

Vulnerabilities October 10, 2026

CVE-2026-105892: Patch for rtMedia closes path traversal

CVE-2026-105892 affects rtMedia for WordPress, BuddyPress and bbPress up to and including 4.7.13. Version 4.7.14 contains a fix.

Read Article

Vulnerabilities October 10, 2026

CVE-2026-103889: Unsigned Code Execution in expivi Plugin

CVE-2026-103889 affects the expivi plugin for WooCommerce up to version 2.16.2. An update to version 2.16.3 or later is available.

Read Article

Vulnerabilities October 8, 2026

IBM DataPower Gateway: multiple critical security vulnerabilities (CVE-2026-16340, CVE-2026-14990, etc.)

Seven critical vulnerabilities in IBM DataPower Gateway, including code execution and LDAP login with an empty password. Fixes: 10.5.0.23, 10.6.0.11, 11.0.0.3.

Read Article

Vulnerabilities October 06, 2026

CVE-2026-32557: SQL Injection in WooCommerce Appointments

CVE-2026-32557 affects WooCommerce Appointments up to and including 5.3.2. The vulnerability is accessible over the network without authentication.

Read Article

Vulnerabilities October 06, 2026

CVE-2026-32568: Remote Code Execution in WooCommerce Designer Pro

CVE-2026-32568 affects WooCommerce Designer Pro up to and including version 1.9.33 and is rated CVSS 9.9.

Read Article

IT Security Blog

Node2Shell: Critical Node.js Security Vulnerability – Find and Fix Affected Software

Latest Posts

Apache Traffic Server: multiple critical security vulnerabilities (CVE-2026-111816, CVE-2026-111815, etc.)

PHP2Shell: Exploit for Critical PHP Vulnerability – Find and Close Affected Software

CVE-2026-103768: Upload Vulnerability in the ELEX HelpDesk Plugin

CVE-2026-87855: Security Update for JTL-Connector for WooCommerce

CVE-2026-70279: XSS Spoofing in Microsoft Exchange Server

CVE-2026-93388: Printcart Plugin Allows Code Execution Without Authentication

CVE-2026-42718 and CVE-2026-42716: Critical WooCommerce Plugin Vulnerabilities

CVE-2026-105892: Patch for rtMedia closes path traversal

CVE-2026-103889: Unsigned Code Execution in expivi Plugin

IBM DataPower Gateway: multiple critical security vulnerabilities (CVE-2026-16340, CVE-2026-14990, etc.)

CVE-2026-32557: SQL Injection in WooCommerce Appointments

CVE-2026-32568: Remote Code Execution in WooCommerce Designer Pro

Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!

© LocateRisk 2026

IT Security Blog

Featured Post

Node2Shell: Critical Node.js Security Vulnerability – Find and Fix Affected Software

Latest Posts

Apache Traffic Server: multiple critical security vulnerabilities (CVE-2026-111816, CVE-2026-111815, etc.)

PHP2Shell: Exploit for Critical PHP Vulnerability – Find and Close Affected Software

CVE-2026-103768: Upload Vulnerability in the ELEX HelpDesk Plugin

CVE-2026-87855: Security Update for JTL-Connector for WooCommerce

CVE-2026-70279: XSS Spoofing in Microsoft Exchange Server

CVE-2026-93388: Printcart Plugin Allows Code Execution Without Authentication

CVE-2026-42718 and CVE-2026-42716: Critical WooCommerce Plugin Vulnerabilities

CVE-2026-105892: Patch for rtMedia closes path traversal

CVE-2026-103889: Unsigned Code Execution in expivi Plugin

IBM DataPower Gateway: multiple critical security vulnerabilities (CVE-2026-16340, CVE-2026-14990, etc.)

CVE-2026-32557: SQL Injection in WooCommerce Appointments

CVE-2026-32568: Remote Code Execution in WooCommerce Designer Pro

Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!

© LocateRisk 2026