[vulnfeed] 20 critical CVEs — 2026-10-06 08:00 UTC
vulnfeed
Critical alert — 2026-10-06 11:26 UTC
20 new critical CVEs
in the last 5 hours — 20 CVSS ≥ 9.0
New vulnerabilities
CVE-2026-32579CRITICAL
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
CVSS 10.0
CVE-2026-39770CRITICAL
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
CVSS 10.0
CVE-2026-39773CRITICAL
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
CVSS 10.0
CVE-2026-32568CRITICAL
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
CVSS 9.9
CVE-2026-39755CRITICAL
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
CVSS 9.9
CVE-2026-39757CRITICAL
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
CVSS 9.9
CVE-2026-39759CRITICAL
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
CVSS 9.9
CVE-2026-39753CRITICAL
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
CVSS 9.8
CVE-2026-39761CRITICAL
Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.
Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.
CVSS 9.8
CVE-2026-39797CRITICAL
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
CVSS 9.8
CVE-2026-94293CRITICAL
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
CVSS 9.3
CVE-2026-85153CRITICAL
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys i
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerabil
CVSS 9.3
CVE-2026-32557CRITICAL
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
CVSS 9.3
CVE-2026-39746CRITICAL
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
CVSS 9.3
CVE-2026-39764CRITICAL
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 v
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
CVSS 9.3
vulnfeed critical alerts — vulnfeed.it.
Unsubscribe
Don't miss what's next. Subscribe to Vulnfeed: