Skip to content

/

ZeroHour

ZeroHour aggregates public sources — security and AI press, vendor advisories, NVD, CISA KEV, FIRST EPSS, leak-site trackers and Have I Been Pwned — and classifies them with AI. Summaries can be wrong: read the original. All times are UTC.

News CVEs Incidents Tags Daily brief Traffic Sources RSS & API Kiosk Health Sitemap

Home
News feed
Exploited now

Security

CVEs
Ransomware & breaches
Threat actors & entities
IOCs

AI

AI & models

Explore

Tags
Daily brief
Analytics
Traffic & readers
Ask the feed
Sources

You

Watchlist
Saved
RSS, API & alerts

06:59 UTC· 6m ago

#cms — news, CVEs and analysis · ZeroHour

today 43 visits · 56 views · 7 reads·all time 17K views

Tag

#cms

8 stories this week · 25 this month · 32 in 6 months · mostly security

stories per day · 30 days

Related#wordpress 12 #path-traversal 9 #rce 9 #flextype 8 #php 7 #patch 4 #stored-xss 4 #xss 4 #cve-2026-87902 3 #poc 3 #authorization-bypass 2 #bludit 2 #exploit-db 2 #expression-injection 2 #file-read 2 #local-file-inclusion 2 #plugin-security 2 #shortcodes 2

23 stories, newest first · one card per story

WordPress.org · Security·23h ago high

WordPress 7.1.2 Release

#wordpress #cve-2026-87902 #rce

SecurityWeek·1d ago high

WordPress Patches ‘Click2Shell’ Vulnerability

#wordpress #click2shell #rce

6 sources 2 min

Ars Technica · AI·1d ago

Trump admin using AI to deny medical care for seniors in disastrous experiment

#cms #government-policy #healthcare-ai

10 min

Wordfence·2d ago

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)

#wordpress #wordfence #vulnerability

Wordfence·4d ago high

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

#wordpress #path-traversal #local-file-inclusion

Hacker News · security·4d ago high

WordPress: Unauthenticated path traversal leading to conditional RCE

#wordpress #path-traversal #rce

Vulnerability

GBHackers·8d ago

WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal

#authorization-bypass #cms #patch

3 min

Cyber Security News·8d ago

WordPress Urges Immediate Update After Fixing 11 Security Vulnerabilities

#authorization-bypass #cms #path-traversal

3 min1

Patchstack·9d ago high

WordPress 7.1.1 Maintenance and Security Release

#cms #patch-release #stored-xss

5 min

WordPress.org · Security·9d ago

WordPress 7.1.1 Maintenance and Security Release

#cms #patching #path-traversal

4 min

Drupal Security Advisories·10d ago

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2026-013

#ckeditor #cms #drupal

Advisory

arXiv cs.CR·11d ago

Plug 'n' Pray: Agentic LLM-based Detection of Potential Log File Exposures in Third-Party Content Management System Plugins

#cms #llm-agents #log-exposure

Research

Full Disclosure·23d ago

Flextype v1.0.0-alpha.3 CMS registerShortcodes() Remote Code Execution via Attacker-Controlled File Inclusion

#cms #file-inclusion #flextype

Vulnerability

Exploit-DB·25d ago

[webapps] Ghost_CMS 6.19.0 - Remote Code Execution

#cms #ghost-cms #open-source

Exploit / PoC

1

Exploit-DB·25d ago

[webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

#bludit #cms #exploit-db

Exploit / PoC

1

Exploit-DB·26d ago

[webapps] Bludit CMS - Stored XSS

#bludit #cms #exploit-db

Exploit / PoC

1

Joomla Security Centre·Aug 17, 2026

[20260810] - Core - Unrestricted uploads of SHTML files

#cms #code-execution #cve-2026-73373

CVE-2026-73373

Joomla Security Centre·Aug 17, 2026

[20260805] - Core - Improper ACL checks for category webservice endpoints

#access-control #acl #api

CVE-2026-72532

Joomla Security Centre·Aug 17, 2026

[20260804] - Core - Improper ACL checks for custom fields webservice endpoints

#access-control #acl #cms

CVE-2026-72531

Joomla Security Centre·Aug 17, 2026

[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints

#access-control #acl #api

CVE-2026-71574

Joomla Security Centre·Aug 17, 2026

[20260802] - Core - Improper CORS origin validation

#cms #cors #joomla

CVE-2026-71573

Joomla Security Centre·Aug 17, 2026

[20260801] - Core - Response header injection in download views

#cms #header-injection #joomla

CVE-2026-71572

WordPress.org · Security·Aug 12, 2026

WordPress 7.0.4 Release

#cms #patch #security-release

Advisory