Security intelligence

Newly published and actively exploited vulnerabilities from official sources: CISA KEV, NVD, ENISA EUVD, GitHub Advisories, OSV, Microsoft, Red Hat, Ubuntu, Debian, php.net, national CERTs (USOM, CERT-EU, NCSC UK, CERT-Bund, CERT-FR, JPCERT/CC) and vendor PSIRTs (Cisco, Fortinet, Palo Alto Networks). Every item states its sources, publication time and verification state.

Last updated: October 25 at 07:05 UTC · 10:05 TRT · 26 of 26 sources reachable · Next Microsoft Patch Tuesday: November 10, 2026

23 of 23 items

CriticalVERIFIEDYesterday
A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4.
Affected: Unitree Robotics — Unitree Go2CVE-2026-115995CVSS 9.4 (v4.0, NVD)EPSS 0% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: NVD, EUVD
CriticalVERIFIEDYesterday
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).
Affected: Oracle Corporation — Oracle Java SECVE-2026-114820CVSS 9.1 (v3.1, EUVD)EPSS 0% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
CriticalVERIFIEDYesterday
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured.
Affected: Python Software Foundation — CPythonCVE-2026-115557CVSS 9.4 (v4.0, EUVD)EPSS 0% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
CriticalVERIFIEDYesterday
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects…
Affected: WPFactory — Product Filter by WBWCVE-2026-112866CVSS 9.3 (v3.1, EUVD)EPSS 0.4% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
CriticalVERIFIEDYesterday
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
Affected: Tribulant Software — NewslettersCVE-2026-94075CVSS 9.8 (v3.1, EUVD)EPSS 0.6% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
CriticalVERIFIEDYesterday
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newslette…
Affected: Tribulant Software — NewslettersCVE-2026-111402CVSS 9.3 (v3.1, EUVD)EPSS 0.4% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
CriticalVERIFIEDYesterday
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
Affected: paytiumsupport — PaytiumCVE-2026-114196CVSS 9.8 (v3.1, EUVD)EPSS 0.6% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
CriticalVERIFIEDYesterday
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthentica…
Affected: Unknown — asVereinbaseCVE-2026-110956CVSS 9.8 (v3.1, EUVD)EPSS 0.2% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
CriticalVERIFIEDYesterday
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for.
Affected: gitroomhq — postiz-appCVE-2026-115933CVSS 9.9 (v3.1, EUVD)EPSS 0% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
CriticalVERIFIEDYesterday
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory.
Affected: gitroomhq — postiz-appCVE-2026-115932CVSS 9.6 (v3.1, EUVD)EPSS 0% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels…
Affected: Knit Pay — UPI QR Code Payment Gateway for WooCommerceCVE-2026-114191CVSS 7.5 (v3.1, EUVD)EPSS 0% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
Affected: Christoph Vielgrader — RelevanssiCVE-2026-114704CVSS 7.2 (v3.1, EUVD)EPSS 0% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from…
Affected: quarka — QA AnalyticsCVE-2026-114697CVSS 7.1 (v3.1, EUVD)EPSS 0.3% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from…
Affected: Bold Grid — W3 Total CacheCVE-2026-114178CVSS 7.1 (v3.1, EUVD)EPSS 0.3% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open!
Affected: Noah Hearle — We’re Open!CVE-2026-112869CVSS 7.1 (v3.1, EUVD)EPSS 0.3% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solut…
Affected: arraytics — WP Event SOlutionCVE-2026-112844CVSS 7.1 (v3.1, EUVD)EPSS 0.3% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better…
Affected: WordPlus — BP Better MessagesCVE-2026-114179CVSS 7.1 (v3.1, EUVD)EPSS 0.3% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infoman…
Affected: Infomaniak Network — VOD InfomaniakCVE-2026-114695CVSS 7.1 (v3.1, EUVD)EPSS 0.3% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: fr…
Affected: Pixelite — Events ManagerCVE-2026-114694CVSS 7.1 (v3.1, EUVD)EPSS 0.3% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, wh…
Affected: Unknown — Download MonitorCVE-2026-112207CVSS 7.1 (v3.1, EUVD)EPSS 0.2% (FIRST)
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: EUVD
HighVERIFIEDYesterday
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such…
Affected: Unknown — GeoDirectoryCVE-2026-113673CVSS 7.2 (v3.1, EUVD)EPSS 0.3% (FIRST)
Operational impact
May allow remote code execution.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Remote code execution
Severity set by the Korantix rule
Sources: EUVD
InformationalVERIFIEDYesterday
DSA-6583-1 libheif - security update
Affected: Debian — libheif
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Move to the vendor's fixed release; apply the workaround if one exists.
Severity set by the Korantix rule
Sources: Debian DSA
InformationalUNCONFIRMEDYesterday
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
Operational impact
Organisations using the affected product may be at risk.
Recommended first step
Wait for the vendor's official advisory and check whether you use the affected products.
Sources: BleepingComputer

Source status

CISA Known Exploited Vulnerabilities: working (October 25 at 06:53 UTC · 09:53 TRT)
USOM — T.C. Siber Güvenlik Başkanlığı: working (October 25 at 06:53 UTC · 09:53 TRT)
Cisco PSIRT: working (October 25 at 06:53 UTC · 09:53 TRT)
CERT-EU — Cybersecurity Service for the EU institutions: working (October 25 at 06:53 UTC · 09:53 TRT)
JPCERT/CC — Japan Computer Emergency Response Team: working (October 25 at 06:53 UTC · 09:53 TRT)
BleepingComputer: working (October 25 at 06:53 UTC · 09:53 TRT)
The Record: working (October 25 at 06:53 UTC · 09:53 TRT)
SANS Internet Storm Center: working (October 25 at 06:53 UTC · 09:53 TRT)
KrebsOnSecurity: working (October 25 at 06:53 UTC · 09:53 TRT)
NIST NVD 2.0 — critical CVEs (last 72 h): working (October 25 at 06:53 UTC · 09:53 TRT)
NIST NVD 2.0 — PHP (CPE php:php, last 14 days): working (October 25 at 06:53 UTC · 09:53 TRT)
ENISA EU Vulnerability Database (CVSS ≥ 7, last 3 days): working (October 25 at 06:53 UTC · 09:53 TRT)
ENISA EUVD — exploited vulnerabilities: working (October 25 at 06:53 UTC · 09:53 TRT)
GitHub Security Advisories (reviewed, all ecosystems): working (October 25 at 06:53 UTC · 09:53 TRT)
GitHub Security Advisories — Composer (PHP): working (October 25 at 06:53 UTC · 09:53 TRT)
OSV.dev — Packagist (PHP) ecosystem: working (October 25 at 06:53 UTC · 09:53 TRT)
Microsoft Security Response Center — Security Update Guide: working (October 25 at 06:53 UTC · 09:53 TRT)
Red Hat Security Data API: working (October 25 at 06:53 UTC · 09:53 TRT)
Ubuntu Security (CVE tracker): working (October 25 at 06:53 UTC · 09:53 TRT)
Debian Security Advisories: working (October 25 at 06:53 UTC · 09:53 TRT)
php.net — release feed (security releases): working (October 25 at 06:53 UTC · 09:53 TRT)
NCSC (UK National Cyber Security Centre): working (October 25 at 06:53 UTC · 09:53 TRT)
BSI CERT-Bund (WID advisories, high/critical, new): working (October 25 at 06:53 UTC · 09:53 TRT)
CERT-FR (ANSSI): working (October 25 at 06:53 UTC · 09:53 TRT)
Fortinet PSIRT (FortiGuard): working (October 25 at 06:53 UTC · 09:53 TRT)
Palo Alto Networks Security Advisories: working (October 25 at 06:53 UTC · 09:53 TRT)

Severity: the vendor's or authority's own rating when it has one; otherwise the documented Korantix rule (a CISA KEV entry is at least High; Critical when used by ransomware or CVSS is 9.0 or higher; without a rating, the band of the published CVSS score). Top priority badge: only when the CVE is in CISA KEV, its FIRST EPSS is at least 0.5 and its published CVSS is at least 9.0. EPSS and CVSS are never estimated; a missing value stays blank. Times are shown in UTC and TRT. When sources disagree, the conflict is shown on the item, not hidden. Source terms: docs/growth/security-intelligence.md. This product uses the NVD API but is not endorsed or certified by the NVD. EPSS scores: FIRST (first.org/epss).