Announcements

CVE-2026-93399 (matched: wordpress)

  • 25th September 2026
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from ...
Continue reading

Check Point Multiple Products: Check Point Multiple Products Improper Certificate Validation Vulnerability

  • 25th September 2026
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.Source: CISA Known Exploited Vulnerabilities Catalog — ...
Continue reading

Check Point Multiple Products: Check Point Multiple Products Path Traversal Vulnerability

  • 25th September 2026
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.Source: CISA Known Exploited Vulnerabilities Catalog — ...
Continue reading

F5 BIG-IP APM: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

  • 25th September 2026

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-94127

Continue reading