[vulnfeed] 43 critical CVEs — 2026-10-10 20:00 UTC
vulnfeed
Critical alert — 2026-10-10 23:44 UTC
43 new critical CVEs
in the last 5 hours — 43 CVSS ≥ 9.0
New vulnerabilities
CVE-2026-42696CRITICAL
Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19
Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 versions.
CVSS 10.0
CVE-2026-62024CRITICAL
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
CVSS 9.9
CVE-2026-62129CRITICAL
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
CVSS 9.9
CVE-2026-105892CRITICAL
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rt
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This is
CVSS 9.8
CVE-2026-106610CRITICAL
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verifica
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a
CVSS 9.8
CVE-2026-39801CRITICAL
Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.
Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.
CVSS 9.8
CVE-2026-42716CRITICAL
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
CVSS 9.8
CVE-2026-42718CRITICAL
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
CVSS 9.8
CVE-2026-42719CRITICAL
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
CVSS 9.8
CVE-2026-42723CRITICAL
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
CVSS 9.8
CVE-2026-62022CRITICAL
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
CVSS 9.8
CVE-2026-62032CRITICAL
Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
CVSS 9.8
CVE-2026-62050CRITICAL
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
CVSS 9.8
CVE-2026-62051CRITICAL
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
CVSS 9.8
CVE-2026-62052CRITICAL
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
CVSS 9.8
vulnfeed critical alerts — vulnfeed.it.
Unsubscribe
Don't miss what's next. Subscribe to Vulnfeed: