News
July 11, 2026 Security Vulnerability Roundup: Seven WordPress Plugins Enable Admin Takeover — Does It Affect You?
SecurityDevelopment
A one-day roundup of the July 11, 2026 vulnerabilities we did not cover individually. Seven WordPress plugins let a single member or contributor account take over the admin, and a 2M-site Elementor add-on is among them. Judge relevance by whether a login is required, and see what ordinary users must act on now.
2026.07.1162 views
News
miniOrange login plugins need 7.8.1 — and the numbering differs
SecurityDevelopment
Two miniOrange WordPress login plugins, Social Login and Register and OAuth SSO, have critical authentication-bypass flaws (CVE-2026-12761, CVE-2026-57807, severity 9.8) that let an unauthenticated attacker take over the administrator account. Update to the latest versions now.
2026.07.1158 views
News
Four Joomla extension flaws: Balbooa Forms 2.4.1 is not enough (CVE-2026-65880)
SecurityDevelopment
A new critical flaw in Balbooa Forms (CVE-2026-65880, CVSS 10.0) is not fixed by 2.4.1 or 2.4.2. If any form uses a Signature field, only 2.4.3 is safe. Four Joomla extension CVEs covered.
2026.07.1165 views
News
9Router default password 123456 (CVE-2026-63732): server takeover risk
SecurityAIDevelopment
9Router, a popular AI coding router, has critical flaws (CVE-2026-55500, 9.9) that leak all stored API keys and tokens, plus a 10.0 unauthenticated RCE. Update to v0.4.80+ and don't expose it to the internet.
2026.07.11326 views
News
IntelliJ IDEA: 10.0 Remote Development hijack flaws (CVE-2026-64812) — update to 2026.2
DevelopmentSecurity
IntelliJ IDEA has a critical flaw (CVE-2026-59792, severity 9.6): opening a crafted project runs attacker code on your machine. All versions before 2026.1.4 and 2026.2 are affected. Update now.
2026.07.11106 views
News
Super Forms CVE-2026-14894: working PoCs are now public
SecurityDevelopment
A flaw (CVE-2026-14894, severity 9.8) in the popular premium WordPress form builder Super Forms lets anyone, with no login, upload a malicious file and run programs on the server to hijack the site. Versions 6.3.313 and earlier are affected. The vendor has released a fix, and updating to the latest version stops it. We explain the scope and what to do now.
2026.07.1042 views
News
Popular AI Agent UI 'Hermes WebUI' Server-Takeover Flaw CVE-2026-58123 — No Password Needed, Plus API-Key Theft; Update Now
DevelopmentAISecurity
A flaw (CVE-2026-58123, severity 9.8) in the popular tool Hermes WebUI—which runs your own AI agent from a browser (15,000+ GitHub stars)—lets attackers take over the server with no password. A second flaw, CVE-2026-58122, strips out paid LLM API keys and messaging credentials. Fixes are out for both, and updating to the latest stops them. We explain the scope and the fix.
2026.07.10101 views
News
UsersWP's Second Flaw CVE-2026-13690 Bypasses 2FA; Update to 1.2.70
SecurityDevelopment
A flaw (CVE-2026-13492) in the WordPress plugin UsersWP—used on over 20,000 sites to add member registration—lets an ordinary user who merely registered delete key files and push toward a full site takeover. Severity is 8.8 out of 10. The fixed version 1.2.66 is already out, and updating stops it. We explain the affected versions and what to do right now.
2026.07.1028 views
News
Metabase CVE-2026-72898 (CVSS 10.0) Leaked Customer Data — Patch Now
SecurityPrivacyDevelopment
A serious flaw (CVE-2026-59827, severity 9.9) in the analytics tool Metabase—used by roughly 50,000 companies—lets attackers take over the server. In many default setups, just an ordinary account able to run SQL can seize the in-house server and steal the credentials of every connected database. A second admin-exploitable hole, CVE-2026-59826, was disclosed at the same time. We explain the affected versions and how to update now.
2026.07.1077 views
News
No-Code App Builder 'Adalo' Flaw CVE-2026-10706 Exposes User Data Across 1M+ Apps — No Patch Yet, Avoid Storing Sensitive Data
SecurityPrivacyDevelopment
A flaw in the popular no-code app builder Adalo (CVE-2026-10706) lets any authenticated user pull the full sign-up data—emails and more—of other people's apps. Over one million apps are affected, and because it is a platform-level flaw, users cannot fix it themselves. With no patch yet, avoid storing sensitive data. We explain the scope, the mechanism, and what to do now.
2026.07.1040 views
News
Popular AI Coding Tool Cline Hijackable by Any Website (CVE-2026-59723): Command Execution and API Key Theft — Update to 3.0.30
AISecurityDevelopment
Cline, an AI coding tool used by over 5 million people, has a critical flaw (CVE-2026-59723, CVSS 8.8). Simply opening a malicious website can hijack the Cline on your machine, run commands, and steal API keys and source code. It is the second same-shaped hole after May. Update to the latest version (3.0.30 or later) now.
2026.07.0980 views
News
Critical SSRF in Repomix (CVE-2026-59702): The Popular AI Code-Packing Tool's Server Could Leak Cloud Keys — Update to 1.14.1
AIDevelopmentSecurity
Repomix, the popular tool that bundles a codebase into one file for AI, has a critical flaw (CVE-2026-59702, CVSS 9.3). A crafted URL could turn its public server into a proxy and steal internal data such as cloud credential keys. The official site is patched; if you self-host, update to 1.14.1 now.
2026.07.0944 views
