PAN-OS: Buffer Overflow Vulnerability via XML Processing

🕵️ RESEARCH & DEEP DIVES

• WordPress Advanced Contact Form 7 DB through 2.1.3 plugin vulnerable to authorization bypass (CVE-2026-18594)
  The Advanced Contact form 7 DB WordPress plugin is vulnerable to an authorization bypass allowing authenticated users to forge form submission data.

  • Affects all versions up to and including 2.1.3 of the Advanced Contact form 7 DB plugin for WordPress.
  • The plugin fails to properly verify user authorization (CWE-862), enabling authenticated attackers with subscriber/custom-level access and above to exploit the flaw.
  • Attackers can import forged CSV submission records into any Contact Form 7 form managed by the plugin via the 'import_cf7_id' parameter.
  • CVSS 3.1 score of 4.3 (Medium); CVE-2026-18594 was assigned by Wordfence, discovered 2026-05-25 and disclosed 2026-09-09.
  Sources 📄 Source: wordfence.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• Builderall Cheetah for WordPress through 3.0.2: Subscriber-level arbitrary post meta modification (CVE-2026-15823)
  The Builderall Cheetah for WordPress plugin up to 3.0.2 lets Subscriber-level users arbitrarily modify post meta via an unauthenticated AJAX handler.

  • Affects sites running the Builderall Cheetah for WordPress plugin versions up to and including 3.0.2.
  • The wp_ajax_ba_cheetah_disable AJAX handler lacks capability and nonce checks (CWE-862), allowing arbitrary post meta modification.
  • Authenticated attackers with Subscriber-level access can disable the page builder layout on any post, including posts owned by other users, by sending a user-controlled ba_cheetah_data[post_id] parameter.
  • The attack sets the _ba_cheetah_enabled post meta to false; CVSS 3.1 score 4.3 (Medium), disclosed 2026-09-09 by Wordfence PRISM.
  Sources 📄 Source: wordfence.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• PAN-OS: Buffer Overflow Vulnerability via XML ProcessingA buffer overflow vul... (5) — <https://cve.threatint.com/CVE/CVE-2026-0310?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Potential Leakage of Nintendo Switch System Information Through a Proximity-B... (5) — <https://cve.threatint.com/CVE/CVE-2026-82079?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable f... (5) — <https://cve.threatint.com/CVE/CVE-2026-84939?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Proto... (5) — <https://cve.threatint.com/CVE/CVE-2026-49362?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Discl... (5) — <https://cve.threatint.com/CVE/CVE-2026-49363?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Arte... (5) — <https://cve.threatint.com/CVE/CVE-2026-49364?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter d... (5) — <https://cve.threatint.com/CVE/CVE-2026-57822?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE proto... (5) — <https://cve.threatint.com/CVE/CVE-2026-57967?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling c... (5) — <https://cve.threatint.com/CVE/CVE-2026-75880?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Direct Download for WooCommerce through 1.19 - Unauthenticated Arbitrary File Read... (5) — <https://cve.threatint.com/CVE/CVE-2026-15019?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Bulk Password Reset through 1.3.3 - Authenticated (Subscriber+) Arbitrary Password... (5) — <https://cve.threatint.com/CVE/CVE-2026-14873?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Easy Google Fonts through 2.0.4 - Authenticated (Author+) Stored Cross-Site Script... (5) — <https://cve.threatint.com/CVE/CVE-2026-4657?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Builderall for WordPress through 3.0.2 - Authenticated (Contributor+) Stored Cross... (5) — <https://cve.threatint.com/CVE/CVE-2026-15820?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• WP BackItUp Community Edition through 2.1.0 - Authenticated (Administrator+) Path ... (5) — <https://cve.threatint.com/CVE/CVE-2026-18386?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Velociraptor VQL injection during notebook restore from backupVelociraptor al... (5) — <https://cve.threatint.com/CVE/CVE-2026-19584?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

• Apple mach_o Archive Parser Integer Underflow Vulnerability (5) — <https://www.reddit.com/r/netsec/comments/1wc87td/apple_mach_o_archive_parser_integer_underflow/|r/netsec>

• Pavlok Wearable Critical Buffer Overflow (CVE-2026-87931) (5) — <https://www.thehackerwire.com/pavlok-wearable-critical-buffer-overflow-cve-2026-87931/|thehackerwire.com (discovered)>

• Innovator Coffee Black Hat Special: Which Security Assumptions Is AI Starting to Change? (5) — <https://securityboulevard.com/2026/09/innovator-coffee-black-hat-special-which-security-assumptions-is-ai-starting-to-change/|securityboulevard.com (discovered)>

• Innovator Coffee EP-43 2026 Blackhat: What’s Crowded and What’s New (5) — <https://securityboulevard.com/2026/09/innovator-coffee-ep-43-2026-blackhat-whats-crowded-and-whats-new/|securityboulevard.com (discovered)>

• Which role in cyber security? (5) — <https://www.reddit.com/r/cybersecurity/comments/1wcakg5/which_role_in_cyber_security/|r/cybersecurity>