Vulnerabilities

mrubyc, a lightweight Ruby VM designed for embedding in microcontroller and IoT firmware, contains a null pointer dereference (CWE-476) in the op_enter() handler of src/vm.c in all versions through 4.0.0. The flaw is triggered when the VM processes a crafted .mrb bytecode file containing an OP_ENTER instruction placed at the top level, causing a NULL dereference during execution. An attacker who can supply such bytecode to an embedding application gains denial of service, since the process crashes; the CVSS 4.0 score of 6.9 (local attack vector, high availability impact) reflects an availability-only issue with no confidentiality or integrity loss. Only applications that execute untrusted or attacker-supplied bytecode in mrubyc are realistically affected, while firmware running solely its own pre-compiled bytecode is not exposed. No in-the-wild exploitation is known and the issue is absent from CISA KEV, but a public proof-of-concept is available on GitHub.

Do: No fixed version is confirmed in the available data, so monitor the mrubyc project for a patched release and update the embedded VM as soon as one is published. Until then, do not feed untrusted or third-party .mrb bytecode files into applications built on mrubyc 4.0.0 or earlier, and audit integrations for any path where user-supplied data can reach bytecode execution. Where untrusted bytecode must be processed, isolate the VM in a separate sandboxed process so a crash cannot take down the host application.

Several Newfold Digital WordPress plugins — the hosting-brand helper plugins for Bluehost, HostGator, Crazy Domains and Web.com — are vulnerable to an unauthenticated authentication bypass (CWE-287) in their bundled wp-module-data module, which is vulnerable in versions up to and including 2.9.4. The module's authenticate() callback runs on the rest_authentication_errors filter, so it is evaluated for every unauthenticated REST API request, and it verifies an HMAC-style Bearer token; when HiiveConnection::get_auth_token() returns false, the secret salt degenerates to the publicly known SHA-256 hash of an empty string (the well-known e3b0c44... digest), while every other hash input — HTTP method, request URL, raw request body and the X-Timestamp header — remains fully attacker-controlled. An unauthenticated attacker can therefore compute a valid Bearer token entirely offline, pass the token equality check, and be logged in via wp_set_current_user() as the first administrator returned by get_users(['role' => 'administrator']). This grants full administrator-level access through the REST API, including arbitrary REST operations such as creating new administrator accounts and achieving complete site takeover. All sites running WP Plugin Crazy Domains <= 2.5.2, WP Plugin Web <= 2.3.4, WP Plugin Hostgator <= 3.1.0 or WP Plugin Bluehost <= 4.17.1 are affected — predominantly sites hosted on Newfold's hosting brands — and the exploitation status is none known: there is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation has been reported (CVSS 3.1: 8.8 high).

Do: Upgrade all four plugins past the vulnerable thresholds — WP Plugin Crazy Domains > 2.5.2, WP Plugin Web > 2.3.4, WP Plugin Hostgator > 3.1.0, WP Plugin Bluehost > 4.17.1 — or at minimum ensure the bundled wp-module-data module is updated beyond 2.9.4; Newfold-managed hosts may apply updates automatically, so verify the running versions. Until patched, consider restricting or auditing unauthenticated access to /wp-json at the web-server or WAF layer, and review REST API logs and the users list for unauthenticated requests that authenticated as an administrator or for unfamiliar administrator accounts created via the REST API.

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress, in all versions up to and including 4.1.22, is vulnerable to a Local File Inclusion (CWE-98) via the 'event_layout' parameter. Any authenticated user with contributor-level access or above can trigger the flaw through the REST API, because the default 'etn_manage_event' capability is assigned to Contributors and allows setting a malicious 'event_layout' value. Successful exploitation causes the server to include and execute arbitrary local .php files, letting the attacker run any PHP code in those files, which can bypass access controls or expose sensitive data, and can lead to full code execution where .php uploads can be made and included. Any WordPress site running Eventin 4.1.22 or earlier that has contributor-level or higher user accounts is affected. There is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and current exploitation appears unlikely (EPSS ~0.6% over 30 days).

Do: Update Eventin to the latest patched release (any version newer than 4.1.22) as soon as one is available. Until patched, audit sites for contributor-level or higher accounts that could set 'event_layout' values via the REST API, consider revoking the 'etn_manage_event' capability from Contributors as an interim mitigation, and check whether any .php file uploads exist on the server that could be included for full code execution.

CVE-2026-87528 is a type confusion flaw (CWE-843) in Rust-based code in Google Chrome on Windows. A remote attacker can trigger it by persuading a user to open a crafted HTML page, causing incorrect type handling in memory. Successful exploitation potentially allows execution of arbitrary code outside the browser sandbox, meaning an attacker's code would run beyond Chrome's renderer-level containment. Users running Google Chrome on Windows prior to 153.0.8010.36 are affected; no other products or platforms are named in the advisory. No in-the-wild exploitation is currently known: the flaw is not in CISA's KEV, EPSS assigns a 0.2% 30-day exploitation probability, and while the CVSS base score is 9.6 (critical), the Chromium project itself rates the issue Medium; one public reference (Chromium issue 539569491) exists.

Do: Update Google Chrome on Windows to 153.0.8010.36 or later, verifying the installed version at chrome://settings/help or chrome://version. No workaround that prevents the type confusion is documented, so prioritize patching, especially for users who browse untrusted web content; note the vendor severity is Medium but the flaw can yield code execution outside the sandbox. Technical details may emerge at Chromium issue 539569491, worth monitoring for indicators or exploit development.

CVE-2026-80093 is a use-after-free memory-safety flaw (CWE-416) in the Windows Cloud Files Mini Filter Driver (cldflt.sys), the in-box kernel filesystem filter that backs cloud placeholder files via the Cloud Files API. An attacker who already holds valid low-privilege credentials on a host triggers the flaw through specific operations against cloud-files placeholders, causing the driver to reference freed kernel memory; the High attack-complexity rating indicates the required conditions do not line up trivially. A successful exploit elevates the attacker's privileges locally, granting full control of the affected machine with high impact to confidentiality, integrity, and availability — the flaw is not remotely exploitable on its own. Virtually every maintained Windows 10/11 and Windows Server deployment ships this driver, so any Windows host where untrusted users can run code is plausibly affected; the available data does not list specific affected builds, and fixes shipped in Microsoft's September 2026 Patch Tuesday. As of the data available there is no public PoC, the CVE is not in CISA KEV, and EPSS is low (0.3%, 28th percentile), indicating no confirmed exploitation in the wild; while the September 2026 release included two zero-days, whether this CVE is among them is not confirmed here.

Do: Apply Microsoft's September 2026 Windows cumulative security updates to all Windows 10/11 clients and Windows Servers, prioritizing multi-user hosts such as RDS/VDI servers, terminal servers, and shared workstations where local logon is common. Because exploitation requires valid local credentials, an interim mitigation is to restrict interactive logon, RDP, and local account creation to trusted users on unpatched hosts. After patching, verify on critical systems that the updated cldflt.sys file version from the September 2026 update is in place.

CVE-2026-69451 is a use-after-free (CWE-416) in Windows Management Instrumentation (WMI), the core management infrastructure component of Microsoft Windows. An authorized attacker holding only a low-privileged account can reach the flaw over a network and trigger it with user interaction and under high attack complexity, likely by racing WMI operations to free and reuse an object. Successful exploitation grants the attacker elevated privileges on the target system, with high confidentiality, integrity, and availability impact per the CVSS 7.1 score. All Windows systems carrying the affected WMI component are potentially affected; the available data does not specify exact affected version ranges or builds, so defenders should consult Microsoft's advisory. Exploitation has not yet been added to CISA KEV and EPSS is only ~0.7% (50th percentile), but one public proof-of-concept is available, and no confirmed in-the-wild exploitation is documented.

Do: Install the Microsoft security update for CVE-2026-69451 as soon as it is available through Windows Update/WSUS, checking Microsoft's advisory for the exact affected builds since version ranges are not listed in the source data. Prioritize patching multi-user hosts such as RDS/VDI servers where low-privileged remote users log in, since exploitation requires an authorized account plus user interaction. Note that a public PoC exists, so monitor WMI-related process and event logs for anomalous activity until systems are patched.

CVE-2026-52307 is an authenticated stored cross-site scripting (XSS) flaw in the Column Management component of ClassCMS 1CMS v5.6. An authenticated user can inject a crafted payload into the title field of a column, which is then stored and executed as arbitrary web scripts or HTML when other users view the affected content. Successful exploitation allows the attacker to run attacker-controlled scripts in the browsers of users who view the injected column, potentially enabling actions such as session hijacking or performing actions under victims' credentials. Only deployments of 1CMS v5.6 are identified as affected in the disclosure. There is no confirmed in-the-wild exploitation: the flaw is not in CISA KEV, EPSS estimates only a 0.3% probability of exploitation in the next 30 days, and one public proof-of-concept reference exists on GitHub.

Do: Audit whether you run 1CMS and confirm the version; operators of v5.6 should restrict which authenticated accounts can edit column titles and sanitize/validate title input as an interim mitigation. Watch the vendor and the referenced PoC (github.com/linan-OO/CVE-2026-52307) for a patched release, and upgrade as soon as a fixed version is published, since no fixed version is specified in the current disclosure. Given the low EPSS score, absence from CISA KEV, and the authentication requirement, treat this as a lower-priority patch pending vendor guidance.

XenForo before 2.3.13 fails to mark refresh tokens as consumed once their parent access token has expired, allowing the same refresh token to be replayed multiple times (CWE-294, authentication bypass by capture-replay). An attacker who has captured a refresh token can repeatedly submit it to mint additional independent access-token/refresh-token pairs, maintaining unauthorized access for the token's full lifetime. The attack is network-based and requires no privileges or user interaction, though the high attack-complexity rating reflects the need to hold a token in the exploitable (expired-parent) state. Any XenForo deployment running an affected version that issues refresh tokens for token-based authentication is exposed. A public proof-of-concept exists on GitHub, but exploitation is not yet reported in the wild: the EPSS score is 0.4% (28th percentile) and the flaw is not in CISA KEV.

Do: Upgrade to XenForo 2.3.13 or later. Administrators who cannot patch immediately should rotate or revoke outstanding refresh tokens and review authentication logs for the same refresh token being exchanged repeatedly for new token pairs. Because exploitation presumes token capture, also check for token leakage in logs, proxies, and third-party integrations.