CVE-2026-103889: Unsigned Code Execution in expivi Plugin
CVE-2026-103889 affects the expivi plugin for WooCommerce up to version 2.16.2. An update to version 2.16.3 or later is available.
Read Article
IT Security Blog
Vulnerabilities & Advisories
Current CVEs, vendor advisories, and specific recommendations for addressing critical security vulnerabilities.
Featured Post
Latest Posts
IBM DataPower Gateway: multiple critical security vulnerabilities (CVE-2026-16340, CVE-2026-14990, etc.)
Seven critical vulnerabilities in IBM DataPower Gateway, including code execution and LDAP login with an empty password. Fixes: 10.5.0.23, 10.6.0.11, 11.0.0.3.
Read Article CVE-2026-32557: SQL Injection in WooCommerce Appointments
CVE-2026-32557 affects WooCommerce Appointments up to and including 5.3.2. The vulnerability is accessible over the network without authentication.
Read Article CVE-2026-32568: Remote Code Execution in WooCommerce Designer Pro
CVE-2026-32568 affects WooCommerce Designer Pro up to and including version 1.9.33 and is rated CVSS 9.9.
Read Article CVE-2026-102795: Apache Traffic Server fixes affected version range
CVE-2026-102795 affects Apache Traffic Server in defined 9.x and 10.x versions. The entry replaces CVE-2026-41920 and mentions fixed releases.
Read Article CVE-2026-93029: Stored XSS in the cPanel-WHM interface
CVE-2026-93029 affects a stored XSS vulnerability in the WHM interface Manage SSL Hosts with a CVSS score of 9.0.
Read Article CVE-2026-93698 and CVE-2026-93697: Security Updates for cPanel and WP Squared
Two critical vulnerabilities in cPanel and WP Squared: Updates available since September 29, 2023. Check patch status and accessible management interfaces now.
Read Article CVE-2026-75957: Authentication Bypass in Ultimate Multisite
CVE-2026-75957 affects Ultimate Multisite up to and including version 2.15.0. A patch is available starting from version 2.15.1.
Read Article CVE-2026-93903: Update LiteSpeed Web Server prior to 6.3.7 build 1
CVE-2026-93903 affects LiteSpeed Web Server prior to 6.3.7 build 1. The manufacturer provides a fix for the bypassing of account isolation.
Read Article CVE-2026-102334: Brute-Force Risk in Nginx Proxy Manager
CVE-2026-102334 affects Nginx Proxy Manager up to 2.16.0. Missing rate limits allow unlimited login and TOTP attempts.
Read Article CVE-2026-61560: Three Critical Vulnerabilities in GitLab-MCP
Three critical vulnerabilities in @zereight/mcp-gitlab affect unprotected MCP endpoints, token leakage, and DNS rebinding.
Read Article CVE-2026-8778: Unauthenticated file upload in WooCommerce plugin
CVE-2026-8778 affects MIPL Grouped Checkout Fields for WooCommerce up to and including 1.2.1.
Read Article CVE-2026-78509: Microsoft Office Vulnerability with CVSS 9.8
CVE-2026-78509 affects multiple Microsoft Office products and has a CVSS score of 9.8.
Read Article
English 
Deutsch 
Français