PULSEUnderground Intel

LIVE24signals / 24h

FEED

ransomumbra reclama a Tharisa · ZA · Manufacturingransomn0n reclama a Chibitek · US · Technologyransomincransom reclama a acmestamping.com · US · Manufacturingransomincransom reclama a harborpacific.com · US · Transportationransomincransom reclama a architekt-vondanwitz.de · DE · Professional Servicesransomtermite reclama a Aon · US · Professional Servicesransomqilin reclama a EPTISA · ES · Professional Servicesransomsilentransomgroup reclama a Andersen Group · Professional Servicesransompanzer reclama a EDFelectronics · Manufacturingransomumbra reclama a Beni Suef Technological University – BTU · EG · Educationransomvexy ransomware reclama a KOOKABARRA JUICE · AU · Retail & E-Commerceransomqilin reclama a BNYH · Financial Servicesransomqilin reclama a Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi · TR · Manufacturingransompanzer reclama a SweetRush · US · Professional Servicesransomumbra reclama a Tharisa · ZA · Manufacturingransomn0n reclama a Chibitek · US · Technologyransomincransom reclama a acmestamping.com · US · Manufacturingransomincransom reclama a harborpacific.com · US · Transportationransomincransom reclama a architekt-vondanwitz.de · DE · Professional Servicesransomtermite reclama a Aon · US · Professional Servicesransomqilin reclama a EPTISA · ES · Professional Servicesransomsilentransomgroup reclama a Andersen Group · Professional Servicesransompanzer reclama a EDFelectronics · Manufacturingransomumbra reclama a Beni Suef Technological University – BTU · EG · Educationransomvexy ransomware reclama a KOOKABARRA JUICE · AU · Retail & E-Commerceransomqilin reclama a BNYH · Financial Servicesransomqilin reclama a Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi · TR · Manufacturingransompanzer reclama a SweetRush · US · Professional Services

CVE WatchOct 6, 2026

CVE-2026-39757

Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.

CVSS

9.9

Critical

EPSS

0.5%

p39

KEV

—

Exploit Today

12

0-100

Published: Oct 6, 2026 · Last modified: Oct 6, 2026 · CWE-434

EPSS · 30d

Not enough EPSS history yet.

Technical description

Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.

Official references

patchstack.comhttps://patchstack.com/database/wordpress/plugin/taskbot/vulnerability/wordpress-taskbot-plugin-6-6-arbitrary-file-upload-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-105868—

——0Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.18h CVE-2026-1058628.7 HIG

——0Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.18h CVE-2026-1040697.2 HIG

——0HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.21h CVE-2026-3977010.0 CRI

——10Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.23h CVE-2026-397599.9 CRI

——12Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.23h CVE-2026-397559.9 CRI

——11Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.23h