UpdraftPlus

UpdraftPlus Data Breach Leads to UpdraftCentral Backdoor Attacks on WordPress Sites UpdraftPlus data breach - stolen keys used in UpdraftCentral backdoor attacks on WordPress sites

UpdraftPlus Data Breach Leads to UpdraftCentral Backdoor Attacks on WordPress Sites

Do Son October 20, 2026

TL;DR TeamUpdraft says attackers likely accessed its customer database over the weekend of 17-18 October. The UpdraftPlus...

Critical UpdraftPlus CVE-2026-10795 Exploit Targets Millions UpdraftPlus CVE-2026-10795, UpdraftPlus authentication bypass, WordPress plugin vulnerability, CVE-2026-10795

UpdraftPlus CVE-2026-10795, UpdraftPlus authentication bypass, WordPress plugin vulnerability, CVE-2026-10795

Critical UpdraftPlus CVE-2026-10795 Exploit Targets Millions

Do Son June 10, 2026

Cybersecurity experts recently identified a massive threat to WordPress websites. Specifically, hackers are actively exploiting a critical...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-110936CVSS 8.4
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link...
Admin intel📅 Updated: Oct 20, 2026
CVE-2020-13125CVSS 7.2
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in...
Watchtower Verified📅 Updated: Oct 20, 2026
CVE-2020-13126CVSS 9.9
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild...
Watchtower Verified📅 Updated: Oct 20, 2026
CVE-2019-20180CVSS 8.0
The TablePress plugin for WordPress is vulnerable to CSV Injection in versions up to and including 1.14 via...
Watchtower Verified📅 Updated: Oct 20, 2026
CVE-2026-111862CVSS 9.8
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123...
Admin intel📅 Updated: Oct 17, 2026
CVE-2026-111357CVSS 7.0
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to...
Watchtower Verified📅 Updated: Oct 17, 2026
CVE-2025-61624CVSS 6.0
An Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0...
CISA KEV📅 Added to KEV: Oct 16, 2026
CVE-2026-102764CVSS 9.3
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the...
CISA KEV📅 Added to KEV: Oct 16, 2026

CVE-2026-77936CVSS 9.3
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added...
📅 Updated: Oct 20, 2026
CVE-2026-77933CVSS 9.3
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and...
📅 Updated: Oct 20, 2026
CVE-2026-77932CVSS 9.3
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock...
📅 Updated: Oct 20, 2026
CVE-2026-75128CVSS 9.3
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication,...
📅 Updated: Oct 20, 2026
CVE-2026-109442CVSS 9.3
piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat...
📅 Updated: Oct 20, 2026
CVE-2026-96252CVSS 9.1
Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform...
📅 Updated: Oct 20, 2026
CVE-2026-101306CVSS 9.8
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the...
📅 Updated: Oct 20, 2026
CVE-2026-105899CVSS 10.0
ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary...
📅 Updated: Oct 20, 2026