CVE-2026-15380

creationtimestamp| type| source ---|---|--- 2026-07-17 07:54:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtbjaewa325...

CVE-2026-9810

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...

CVE-2018-14816

creationtimestamp| type| source ---|---|--- 2026-07-17 07:00:04+00:00| seen| Telegram/pS736wy1q4JTpyQ27GThkrd-KM7MPYTW9rtTHg4MZzf-Jty 2026-07-18 00:00:37+00:00| seen| Telegram/pS736wy1q4JTpyQ27GThkrd-KM7MPYTW9rtTHg4MZzf-Jty...

CVE-2026-59173

creationtimestamp| type| source ---|---|--- 2026-07-17 06:39:19+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqt5cimvnh2p 2026-07-23 15:01:30+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrd45xpjlq2p...

CVE-2026-62764

creationtimestamp| type| source ---|---|--- 2026-07-17 06:34:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqt4zjdzoo2e 2026-07-17 14:26:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtxfpq6gq2i...

CVE-2026-9810 AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...

CVE-2026-9810

The CVE-2026-9810 entry concerns the AI Copilot WordPress plugin prior to version 1.5.4. The root cause is that the plugin does not bind OAuth access tokens to a WordPress user, allowing any valid token to be treated as an administrator session. Consequently, unauthenticated attackers completing ...

EUVD-2026-45150

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...

CVE-2026-9046

creationtimestamp| type| source ---|---|--- 2026-07-17 05:13:21+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqsyirmdtq2e 2026-07-17 05:13:36+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116933605175540875...

CVE-2026-24227

creationtimestamp| type| source ---|---|--- 2026-07-17 03:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqstmpirax2a...

CVE-2026-62207

creationtimestamp| type| source ---|---|--- 2026-07-17 02:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsqkt3uoy2m...

CVE-2026-14956

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...

CVE-2026-62321

creationtimestamp| type| source ---|---|--- 2026-07-17 02:01:13+00:00| seen| https://bsky.app/profile/slackers.it/post/3mqsnr7xax22x...

EUVD-2026-45123

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...

CVE-2026-14956 Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-fie...

CVE-2026-44453

creationtimestamp| type| source ---|---|--- 2026-07-17 00:39:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsj7gczaa2n...

CVE-2026-44434

creationtimestamp| type| source ---|---|--- 2026-07-17 00:29:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsinjcw2422...

CVE-2026-62241

creationtimestamp| type| source ---|---|--- 2026-07-17 00:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqsidieaof2d 2026-07-17 01:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116932727657867490 2026-07-17 01:30:28+00:00| seen|...

EUVD-2026-45121

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...

CVE-2026-62233 grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achiev...