CVE-2026-109516: Account takeover via WooCommerce plugin
CVE-2026-109516 affects the WordPress plugin Bot for Telegram on WooCommerce and can allow unauthenticated account takeovers.
Read ArticleIT Security Blog
Current security alerts, regulatory guidance and practical knowledge for well-founded cyber risk decisions.
Latest Posts
Node2Shell: Critical Node.js Security Vulnerability – Find and Fix Affected Software
Node2Shell (CVE-2026-111497): critical vulnerability in Node.js, proof of concept publicly available. Here's how to find affected software and close the gap.
Read Article Apache Traffic Server: multiple critical security vulnerabilities (CVE-2026-111816, CVE-2026-111815, etc.)
Apache Traffic Server has several critical vulnerabilities, including CVE-2026-111816 (CVSS 9.3) and CVE-2026-111815 (CVSS 10). Cache poisoning, HTTP desynchronization, and other attack vectors are possible. Patches available.
Read Article
PHP2Shell: Exploit for Critical PHP Vulnerability – Find and Close Affected Software
PHP2Shell is being exploited. Here's how to find affected PHP software in your inventory and close CVE-2026-109618 and CVE-2026-109619 with an update.
Read Article CVE-2026-103768: Upload Vulnerability in the ELEX HelpDesk Plugin
CVE-2026-103768 affects the ELEX WordPress HelpDesk & Customer Ticketing System up to version 3.3.7. Version 3.3.8 fixes the vulnerability.
Read Article CVE-2026-87855: Security Update for JTL-Connector for WooCommerce
CVE-2026-87855 affects JTL-Connector for WooCommerce up to version 2.4.3. Version 2.4.4 or higher fixes the vulnerability.
Read Article CVE-2026-70279: XSS Spoofing in Microsoft Exchange Server
CVE-2026-70279 is an XSS spoofing vulnerability in Microsoft Exchange Server.
Read Article CVE-2026-93388: Printcart Plugin Allows Code Execution Without Authentication
CVE-2026-93388 affects the Printcart Store Plugin for WooCommerce.
Read Article CVE-2026-42718 and CVE-2026-42716: Critical WooCommerce Plugin Vulnerabilities
CVE-2026-42718 affects Booster for WooCommerce up to and including 8.4.0. CVE-2026-42716 affects Payever - WooCommerce Gateway up to and including 4.8.2.
Read Article CVE-2026-105892: Patch for rtMedia closes path traversal
CVE-2026-105892 affects rtMedia for WordPress, BuddyPress and bbPress up to and including 4.7.13. Version 4.7.14 contains a fix.
Read Article CVE-2026-103889: Unsigned Code Execution in expivi Plugin
CVE-2026-103889 affects the expivi plugin for WooCommerce up to version 2.16.2. An update to version 2.16.3 or later is available.
Read Article IBM DataPower Gateway: multiple critical security vulnerabilities (CVE-2026-16340, CVE-2026-14990, etc.)
Seven critical vulnerabilities in IBM DataPower Gateway, including code execution and LDAP login with an empty password. Fixes: 10.5.0.23, 10.6.0.11, 11.0.0.3.
Read Article CVE-2026-32557: SQL Injection in WooCommerce Appointments
CVE-2026-32557 affects WooCommerce Appointments up to and including 5.3.2. The vulnerability is accessible over the network without authentication.
Read Article
English 
Deutsch 
Français