CVE-2026-109220: PHP Object Injection in the WooCommerce plugin pdf-for-woocommerce
CVE-2026-109220 affects pdf-for-woocommerce up to version 7.1.1. An update to version 7.2.0 is available.
Read Article
IT Security Blog
Vulnerabilities & Advisories
Current CVEs, vendor advisories, and specific recommendations for addressing critical security vulnerabilities.
Featured Post
Latest Posts
CVE-2026-61992: PHP Object Injection in GEO my WP
CVE-2026-61992 affects GEO my WP up to and including version 4.5.5.3. A patched version is available.
Read Article CVE-2026-109516: Account takeover via WooCommerce plugin
CVE-2026-109516 affects the WordPress plugin Bot for Telegram on WooCommerce and can allow unauthenticated account takeovers.
Read Article
Node2Shell: Critical Node.js Security Vulnerability – Find and Fix Affected Software
Node2Shell (CVE-2026-111497): critical vulnerability in Node.js, proof of concept publicly available. Here's how to find affected software and close the gap.
Read Article Apache Traffic Server: multiple critical security vulnerabilities (CVE-2026-111816, CVE-2026-111815, etc.)
Apache Traffic Server has several critical vulnerabilities, including CVE-2026-111816 (CVSS 9.3) and CVE-2026-111815 (CVSS 10). Cache poisoning, HTTP desynchronization, and other attack vectors are possible. Patches available.
Read Article
PHP2Shell: Exploit for Critical PHP Vulnerability – Find and Close Affected Software
PHP2Shell is being exploited. Here's how to find affected PHP software in your inventory and close CVE-2026-109618 and CVE-2026-109619 with an update.
Read Article CVE-2026-103768: Upload Vulnerability in the ELEX HelpDesk Plugin
CVE-2026-103768 affects the ELEX WordPress HelpDesk & Customer Ticketing System up to version 3.3.7. Version 3.3.8 fixes the vulnerability.
Read Article CVE-2026-87855: Security Update for JTL-Connector for WooCommerce
CVE-2026-87855 affects JTL-Connector for WooCommerce up to version 2.4.3. Version 2.4.4 or higher fixes the vulnerability.
Read Article CVE-2026-70279: XSS Spoofing in Microsoft Exchange Server
CVE-2026-70279 is an XSS spoofing vulnerability in Microsoft Exchange Server.
Read Article CVE-2026-93388: Printcart Plugin Allows Code Execution Without Authentication
CVE-2026-93388 affects the Printcart Store Plugin for WooCommerce.
Read Article CVE-2026-42718 and CVE-2026-42716: Critical WooCommerce Plugin Vulnerabilities
CVE-2026-42718 affects Booster for WooCommerce up to and including 8.4.0. CVE-2026-42716 affects Payever - WooCommerce Gateway up to and including 4.8.2.
Read Article CVE-2026-105892: Patch for rtMedia closes path traversal
CVE-2026-105892 affects rtMedia for WordPress, BuddyPress and bbPress up to and including 4.7.13. Version 4.7.14 contains a fix.
Read Article CVE-2026-103889: Unsigned Code Execution in expivi Plugin
CVE-2026-103889 affects the expivi plugin for WooCommerce up to version 2.16.2. An update to version 2.16.3 or later is available.
Read Article
English 
Deutsch 
Français