[vulnfeed] 7 critical CVEs — 2026-10-02 12:00 UTC
vulnfeed
Critical alert — 2026-10-02 14:54 UTC
7 new critical CVEs
in the last 5 hours — 7 CVSS ≥ 9.0
New vulnerabilities
CVE-2026-94541CRITICAL
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in a
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying t
CVSS 9.8
CVE-2026-19652CRITICAL
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and includin
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new use
CVSS 9.8
CVE-2026-86325CRITICAL
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vul
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter whe
CVSS 9.4
CVE-2026-104610CRITICAL
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the func
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such man
CVSS 9.3
CVE-2026-91135CRITICAL
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the comp
CVSS 9.2
CVE-2026-104467CRITICAL
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. A
CVSS 9.2
CVE-2026-83632CRITICAL
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overfl
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.25.0.
CVSS 9.2
vulnfeed critical alerts — vulnfeed.it.
Unsubscribe
Don't miss what's next. Subscribe to Vulnfeed: