The National Vulnerability Database (NVD) published 4 CVEs rated Critical under CVSS v3 in the 26 hours to this report. Descriptions below are quoted directly from NVD. Scores are NVD or CNA base scores; always confirm against the vendor advisory before prioritizing.
Critical CVEs (NVD)
| CVE | CVSS | Description (NVD) |
|---|---|---|
| CVE-2026-109218 | 9.8 | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. Th… |
| CVE-2026-84999 | 9.8 | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before move_uploaded_file() is called, combined with no nonce or ca… |
| CVE-2026-106013 | 9.8 | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for their access token, the handler never calls setOauthToken() to reassign the returned credentials to the TwitterOAuth client, causi… |
| CVE-2026-112352 | 9.1 | Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login … |
New advisories from CERTs and vendors
Cisco PSIRT
Canadian Centre for Cyber Security
Microsoft MSRC
- CVE-2026-62765 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-88078 Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-96196 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- CVE-2026-20942 Microsoft Edge (Chromium-based) Spoofing Vulnerability