Published threat advisories for October 15, 2026

A critical vulnerability exists in a WordPress optimization plugin due to improper file validation and a leaked authentication token, allowing unauthenticated attackers to upload executable files and potentially achieve remote code execution. This poses a significant risk if the plugin is in use and accessible online.

NVD modified: NVD date unavailable

A vulnerability in Znuny allows attackers to bypass login procedures and gain unauthorized access by manipulating an HTTP header, potentially impersonating any user, including administrators. This could lead to unauthorized access to confidential data and system controls. You should care because your Znuny systems may

NVD modified: NVD date unavailable

A vulnerability in the Wheels framework allows SQL injection when parsing user-supplied values, potentially exposing authentication, password-reset, or token lookup data to unauthorized access. This risk exists if applications pass request data to dynamic finder functions, though numeric-column values are unaffected. T

NVD modified: NVD date unavailable