Published threat advisories for October 28, 2026

The Pie Register Premium WordPress plugin has a critical vulnerability that allows unauthenticated attackers to upload and execute dangerous files via its file upload function. This could lead to remote code execution by uploading executable scripts, as the plugin does not adequately validate file types or check user p

NVD modified: NVD date unavailable

A vulnerability in llama.cpp's RDMA transport allows unauthenticated peers to cause a stack overflow, potentially crashing the server or enabling code execution. This issue is relevant if RDMA capabilities are advertised by a peer, which is more common in specialized networks than public-facing applications.

NVD modified: NVD date unavailable

The Jupiter X Core WordPress plugin has a critical authentication bypass vulnerability in its Twitter/X social login handler. This flaw allows unauthenticated attackers to gain administrative access by impersonating the X application owner, typically the site administrator. The vulnerability occurs because the plugin m

NVD modified: NVD date unavailable

A critical vulnerability exists in Jackson databind that allows attackers to execute arbitrary commands by sending specially crafted JSON. This bypasses validation for class names within generic types when default typing is enabled. Organizations should confirm if this technology is used and exposed to external inputs.

NVD modified: NVD date unavailable