Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
21 / 21 results
criticalbug_reportVulnerabilityElementor Pro CVE-2026-32475 actively exploited for webshell uploads
Elementor Pro plugin for WordPress versions 4.2.1 and earlier. Affects sites with published Elementor Pro Form widgets containing File Upload fields. Over 6 million active installations potentially at risk.
criticalbug_reportVulnerabilityCritical WordPress plugin flaws enable auth bypass and RCE on popular sites
WPMU DEV Dashboard plugin ≤5.0.1 (CVE-2026-76581), Avada theme ≤7.16 with Fusion Builder ≤3.16 (CVE-2026-18431), TranslatePress ≤3.3.1 with specific config (CVE-2026-19632), Pods plugin ≤3.3.9 (CVE-2026-19598), GiveWP plugin ≤4.16.7.1 (CVE-2026-82222…
criticalbug_reportVulnerabilityNext.js critical RCE flaws in AVIF processing and Windows path traversal
Next.js versions 13.4–15.5.23 and 16.0–16.3.2. CVE-2026-75604 (Windows path traversal, CVSS 9.0) affects Windows-hosted servers using Pages Router or App Router without Cache Components.
criticalbug_reportVulnerabilityAvada WordPress theme RCE chain affects sites with theme + plugin active
Avada WordPress theme versions up to 7.16 and Fusion Builder plugin versions up to 3.16. Exploitation requires both components to be active simultaneously.
criticalbug_reportVulnerabilityElementor Pro WordPress plugin allows arbitrary file upload and RCE
Elementor Pro WordPress plugin. Specific vulnerable versions not disclosed in available data. Affects WordPress sites with Elementor Pro installed.
criticalbug_reportVulnerabilityForminator WordPress plugin RCE affects 600K+ sites via file upload bypass
Forminator Forms WordPress plugin versions ≤1.56.1. Affects 600,000+ active installations. Exploitation requires a form with both File Upload and Select fields. Sites using custom file upload storage paths are at higher risk.
highbug_reportVulnerabilityWordPress pre-auth XSS on login page enables RCE via admin interaction
WordPress CMS all versions prior to 7.0.3. Patches backported to 4.7 branch and newer. Versions older than 4.7 remain vulnerable and unpatched. Default installations affected; no special hosting configuration required.
criticalbug_reportVulnerabilityTerraform MCP, Veeam VSPC, Django patch 11 flaws including CVSS 10.0 bug
HashiCorp Terraform MCP Server versions 0.2.1–1.0.0 (Streamable HTTP mode only); Veeam Service Provider Console versions 9.2.1.33875 and earlier (all version 9 builds before 9.3); Django versions prior to 6.0.8 and 5.2.17 (GeoDjango spatial field con…
criticalbug_reportVulnerabilityWordPress Core RCE flaws CVE-2026-63030, CVE-2026-60137 under active exploit
WordPress Core (specific versions not disclosed in advisory). Two remote code execution vulnerabilities (CVE-2026-63030, CVE-2026-60137) affecting the core platform.
criticalbug_reportVulnerabilityWordPress Core RCE "wp2shell" exploits now public, patch immediately
WordPress Core (specific versions not disclosed in provided data). Vulnerability enables remote code execution. Public exploits available under the name "wp2shell".
criticalbug_reportVulnerabilityWordPress 6.9–7.0 unauthenticated RCE patched, forced auto-update active
WordPress core versions 6.9.0–6.9.4 and 7.0.0–7.0.1. All sites running these versions are vulnerable to unauthenticated remote code execution via anonymous HTTP requests. Patched in 6.9.5 and 7.0.2.
highbug_reportVulnerabilityShapedPlugin WordPress Pro plugins backdoored via compromised update channel
Multiple ShapedPlugin Pro WordPress plugins distributed through official licensed update channels. Exact plugin names and affected versions not specified.
highbug_reportVulnerabilityShapedPlugin WordPress plugins compromised in supply chain attack
Multiple WordPress plugins from ShapedPlugin vendor. Infected releases distributed to paying customers via official update mechanism. Specific plugin names and version numbers not disclosed in provided data.
criticalbug_reportVulnerabilityCritical vulnerability in Joomla Content Editor (JCE) requires urgent patching
Joomla Content Editor (JCE) extension for Joomla CMS. Specific affected versions not disclosed in advisory. All Joomla sites using the JCE extension should be considered at risk pending vendor confirmation.
highbug_reportVulnerabilityAwesome Motive CDN breach compromises WordPress plugins in supply-chain attack
WordPress plugins OptinMonster, TrustPulse, and PushEngage distributed via Awesome Motive's CDN. All versions served through the compromised CDN infrastructure are potentially affected.
criticalbug_reportVulnerabilityEverest Forms Pro WordPress plugin under active exploit for site takeover
Everest Forms Pro plugin for WordPress. Specific affected versions not disclosed. All WordPress sites running this premium plugin are potentially at risk.
criticalbug_reportVulnerabilityActive exploitation of RCE flaw in Everest Forms Pro WordPress plugin
Everest Forms Pro WordPress plugin versions up to 1.9.12. Approximately 4,000 active installations at risk.
criticalbug_reportVulnerabilityWP Maps Pro plugin exploited to create rogue admin accounts on WordPress
WP Maps Pro WordPress plugin (all versions prior to patch). Over 15,000 installations via Envato Market. Affects WordPress sites using this plugin for Google Maps integration.
highbug_reportVulnerabilityLaravel-Lang packages compromised to deliver credential-stealing malware
Multiple Laravel-Lang PHP packages compromised: laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions. Affects Laravel PHP applications using these localization packages.
criticalbug_reportVulnerabilityCritical SQL injection in Drupal Core requires immediate patching
Drupal Core, all versions (specific affected versions not disclosed in alert). Impacts all Drupal installations until patched.
criticalbug_reportVulnerabilityReact Server Components RCE flaw enables unauthenticated remote execution
React Server Components and integrating frameworks (e.g., Next.js, Remix). All versions using React Server Components are potentially affected until patched.