Veeam Backup and Replication Remote Code Execution via Deserialization Allows Domain User Takeover (CVE-2026-44963)

Scope: Veeam Backup and Replication Version 12.x (All Builds up to and Including 12.3.2.4465) Joined to a Windows Domain

Severity: High

Read More

Open VSX Registry Stored XSS Enables Supply Chain Attack Against VS Code, Cursor, and Windsurf (CVE-2026-13323)

Scope: Open VSX Registry Versions Prior to 1.0.2 (Affects VS Code, VSCodium, Cursor, Windsurf, and Other Editors)

Severity: High

Read More

Custom Payment Gateways for WooCommerce Unauthenticated Stored XSS in Checkout Fields (CVE-2026-7517)

Scope: Custom Payment Gateways for WooCommerce Plugin Versions up to and Including 2.1.0

Severity: High

Read More

Download Manager WordPress Plugin Authenticated Stored XSS via Shortcode Attribute (CVE-2026-13733)

Scope: Download Manager WordPress Plugin Versions up to and Including 3.3.60

Severity: Medium

Read More

WP-BusinessDirectory WordPress Plugin Unauthenticated Arbitrary File Deletion (CVE-2026-6070)

Scope: WP-BusinessDirectory WordPress Plugin Versions up to and Including 4.0.1

Severity: Red

Read More

RegistrationMagic WordPress Plugin CSRF to Privilege Escalation Granting Admin Access (CVE-2026-12158)

Scope: RegistrationMagic Plugin Versions up to and Including 6.0.9.1

Severity: High

Read More