Skip to content
Noroxi

Exploited this week

Vulnerabilities confirmed exploited, with new exploit code or notable on WordPress between 2026-10-08 and 2026-10-15. Updated hourly; the same digest goes out by email every Monday.

Each line opens the record on Noroxi: affected versions, fix and priority. No exploit links.

Noroxi

Exploited this week

One email every Monday: what entered CISA KEV, was weaponized or got exploit code in the last 7 days, plus notable WordPress issues. No account needed; unsubscribe in one click.

Your address is used only for this email and never shared.

Is your WordPress site on this list?

WP Lens reads your site's plugin, theme and WordPress versions from the outside and matches them to known vulnerabilities. Works without an account.

Added to CISA KEV (exploited in the wild) 11

  • CVE-2026-76519

    Cisco Secure Email Gateway Arbitrary File Write Vulnerability

    Criticalcisco secure emailCVSS 9.8

  • CVE-2026-105134

    Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

    CriticalahsaycbsCVSS 9.3

  • CVE-2026-0322

    PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

    Highpalo alto networks cloud ngfwCVSS 8.6

  • CVE-2026-105133

    Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

    MediumahsaycbsCVSS 5.5

  • CVE-2026-104935

    Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute…

    Highivanti connect secureCVSS 8.6

  • CVE-2026-96951

    Windows Shell Security Feature Bypass Vulnerability

    Highmicrosoft outlook webCVSS 8.8

  • CVE-2015-3306

    The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr…

    CriticalproftpdCVSS 10.0

  • CVE-2016-3081

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled,…

    Highapache strutsCVSS 8.1

  • CVE-2015-5477

    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service…

    Highisc bindCVSS 7.5

  • CVE-2021-3199

    Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when…

    Criticalonlyoffice document serverCVSS 9.8

  • CVE-2023-22894

    Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by…

    MediumstrapiCVSS 4.9

Newly weaponized (Metasploit / ready-made module) 4

  • CVE-2024-9264

    Grafana SQL Expressions allow for remote code execution

    CriticalgrafanaCVSS 9.4

  • CVE-2026-0769

    Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability

    CriticallangflowCVSS 9.8

  • CVE-2026-0768

    Langflow code Code Injection Remote Code Execution Vulnerability

    CriticallangflowCVSS 9.8

  • CVE-2026-27960

    OpenCTI privilege escalation and unauthenticated access via default admin account

    Criticalciteum openctiCVSS 9.8

Running any of these? Add your stack and we'll tell you when a product you use enters KEV or gets exploit code.

New proof-of-concept code 8

  • CVE-2022-28108

    Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as…

    Highselenium gridCVSS 8.8

  • CVE-2026-80462

    Privilege Escalation in Progress Chef Automate

    Criticalprogress software chef automateCVSS 10.0

  • CVE-2026-54617

    GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler

    Criticalgravitlauncher launcherCVSS 9.8

  • CVE-2026-27604

    FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions

    CriticalfossbillingCVSS 10.0

  • CVE-2026-92956

    vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

    Criticalpatriksimek vm2CVSS 10.0

  • CVE-2026-97229

    Integer Overflow or Wraparound in GitLab

    CriticalgitlabCVSS 10.0

  • CVE-2026-102255

    A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended…

    Criticalsonicwall sma1000CVSS 10.0

  • CVE-2026-33712

    TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls

    Criticalbaptistearno typebot.ioCVSS 10.0

Biggest exploit-probability jumps (EPSS, 7 days) 1

  • CVE-2026-35273

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment…

    Criticaloracle peoplesoft enterprise peopletoolsCVSS 9.8EPSS +87 pts

WordPress: new critical/high plugin and theme vulnerabilities 8

  • CVE-2026-106608

    WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

    Highautomattic woocommerceCVSS 7.2WooCommerce · 7,000,000+ installs

  • CVE-2026-97278

    WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

    Highwp syntex polylangCVSS 7.2Polylang · 900,000+ installs

  • CVE-2026-105436

    WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability

    Highmainwp childCVSS 8.8MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites · 700,000+ installs

  • CVE-2026-92097

    Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

    Criticalholithemes click to chat – holithemesCVSS 9.1Click to Chat – HoliThemes · 600,000+ installs

  • CVE-2026-96341

    WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

    Highwpmu dev forminatorCVSS 8.2Forminator Forms – Contact Form, Payment Form & Custom Form Builder · 600,000+ installs

  • CVE-2026-65459

    WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

    Highwpmu dev forminatorCVSS 7.5Forminator Forms – Contact Form, Payment Form & Custom Form Builder · 600,000+ installs

  • CVE-2026-96336

    WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

    Highwpmu dev forminatorCVSS 7.5Forminator Forms – Contact Form, Payment Form & Custom Form Builder · 600,000+ installs

  • CVE-2026-102388

    WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

    Highwpmu dev forminatorCVSS 7.1Forminator Forms – Contact Form, Payment Form & Custom Form Builder · 600,000+ installs

Is your WordPress site on this list?

WP Lens reads your site's plugin, theme and WordPress versions from the outside and matches them to known vulnerabilities. Works without an account.

Free tools

Get only what affects you

  • Stack alerts: add the products and versions you run, get the new CVEs that affect them
  • Port scanning: 5 full scans a day (members only)
  • Uptime monitoring: 1 site, instant email when it goes down
  • Verify your domain: subdomains and takeover risk scanned every week
  • 10 scans an hour on the security tools (3 a day without an account), an API key and MCP

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.