PULSEUnderground Intel

EN VIVO34señales / 24h

FEED

ransomplay reclama a Signature Services · Professional Servicesransomplay reclama a GCATS Investments · US · Financial Servicesransomplay reclama a Platinum Group · SG · Manufacturingransomlynx reclama a www.jerryleigh.com · US · Otherransomlynx reclama a www.talbotdes.org · GB · Otherransomgammax reclama a King International LLC · US · Otherransomqilin reclama a AmSpec · US · Energy & Utilitiesransomqilin reclama a ALIZE (alize-sud.fr) · FR · Professional Servicesransomqilin reclama a Jakle & Alexander · US · Not Foundransomqilin reclama a Akuur Law Firm · TR · Professional Servicesransomqilin reclama a J&T Bank and Trust · US · Financial Servicesransombravox reclama a MITC AG · CH · Otherransomakira reclama a Basic Grain Products · Agriculture and Food Productionransomakira reclama a Pharma Test Apparatebau AG · CH · Manufacturingransomplay reclama a Signature Services · Professional Servicesransomplay reclama a GCATS Investments · US · Financial Servicesransomplay reclama a Platinum Group · SG · Manufacturingransomlynx reclama a www.jerryleigh.com · US · Otherransomlynx reclama a www.talbotdes.org · GB · Otherransomgammax reclama a King International LLC · US · Otherransomqilin reclama a AmSpec · US · Energy & Utilitiesransomqilin reclama a ALIZE (alize-sud.fr) · FR · Professional Servicesransomqilin reclama a Jakle & Alexander · US · Not Foundransomqilin reclama a Akuur Law Firm · TR · Professional Servicesransomqilin reclama a J&T Bank and Trust · US · Financial Servicesransombravox reclama a MITC AG · CH · Otherransomakira reclama a Basic Grain Products · Agriculture and Food Productionransomakira reclama a Pharma Test Apparatebau AG · CH · Manufacturing

← Todos los CVEs

CVE Watch6 ago 2026

CVE-2026-65502

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.

CVSS

5.3

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 6 ago 2026 · Última mod.: 6 ago 2026 · CWE-290

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.

Referencias oficiales

patchstack.comhttps://patchstack.com/database/wordpress/plugin/bdthemes-element-pack-lite/vulnerability/wordpress-element-pack-elementor-addons-plugin-8-7-13-captcha-bypass-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-655708.1 ALT

———Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.8h CVE-2026-324695.3 MED

———Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.7h CVE-2026-48063—

——2Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync. This issue has been fixed in versions 6.7.22 and 7.0.0-rc12.2d CVE-2026-148405.3 MED

——1The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.1d CVE-2026-288129.8 CRÍ

——7UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.1d CVE-2026-131435.3 MED

——4The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.7d